forked from aniani/vim
patch 9.1.0017: [security]: use-after-free in eval1_emsg()
Problem: use-after-free in eval1_emsg() when an empty
line follows a lambda (by @yu3s)
Solution: only set evalarg->eval_using_cmdline = FALSE when
the *arg pointer is not null
fixes: #13833
closes: #13841
Signed-off-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
committed by
Christian Brabandt
parent
71d0ba07a3
commit
28d71b566a
@@ -4906,6 +4906,31 @@ def Test_for_stmt_space_before_type()
|
||||
v9.CheckSourceFailure(lines, 'E1059: No white space allowed before colon: :number in range(10)', 2)
|
||||
enddef
|
||||
|
||||
" This test used to cause an use-after-free memory access
|
||||
def Test_for_empty_line_after_lambda()
|
||||
var lines =<< trim END
|
||||
vim9script
|
||||
echomsg range(0, 2)->map((_, v) => {
|
||||
return 1
|
||||
})
|
||||
|
||||
assert_equal('[1, 1, 1]', v:statusmsg)
|
||||
END
|
||||
v9.CheckSourceSuccess(lines)
|
||||
|
||||
lines =<< trim END
|
||||
vim9script
|
||||
echomsg range(0, 1)->map((_, v) => {
|
||||
return 1
|
||||
}) range(0, 1)->map((_, v) => {
|
||||
return 2
|
||||
}) # comment
|
||||
|
||||
assert_equal('[1, 1] [2, 2]', v:statusmsg)
|
||||
END
|
||||
v9.CheckSourceSuccess(lines)
|
||||
enddef
|
||||
|
||||
" Keep this last, it messes up highlighting.
|
||||
def Test_substitute_cmd()
|
||||
new
|
||||
|
||||
Reference in New Issue
Block a user