1
0
forked from aniani/vim

patch 9.1.1043: [security]: segfault in win_line()

Problem:  [security]: segfault in win_line()
          (fizz-is-on-the-way)
Solution: Check that ScreenLines is not NULL

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-j3g9-wg22-v955

Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Christian Brabandt
2025-01-20 22:55:57 +01:00
parent 4cbc54a743
commit 9d1bed5ecc
4 changed files with 13 additions and 2 deletions

View File

@@ -4478,13 +4478,15 @@ gui_do_scroll(void)
/* /*
* Don't call updateWindow() when nothing has changed (it will overwrite * Don't call updateWindow() when nothing has changed (it will overwrite
* the status line!). * the status line!).
*
* Check for ScreenLines, because in ex-mode, we don't have a valid display.
*/ */
if (old_topline != wp->w_topline if (ScreenLines != NULL && (old_topline != wp->w_topline
|| wp->w_redr_type != 0 || wp->w_redr_type != 0
#ifdef FEAT_DIFF #ifdef FEAT_DIFF
|| old_topfill != wp->w_topfill || old_topfill != wp->w_topfill
#endif #endif
) ))
{ {
int type = UPD_VALID; int type = UPD_VALID;

View File

@@ -0,0 +1 @@
vdivvi|gIv|÷<>X<><58>\<5C><>,X<><58>X<EFBFBD><58>\<5C><>#

View File

@@ -234,6 +234,12 @@ func Test_crash1_3()
call term_sendkeys(buf, args) call term_sendkeys(buf, args)
call TermWait(buf, 50) call TermWait(buf, 50)
let file = 'crash/ex_redraw_crash'
let cmn_args = "%s -u NONE -i NONE -n -m -X -Z -e -s -S %s -c ':qa!'"
let args = printf(cmn_args, vim, file)
call term_sendkeys(buf, args)
call TermWait(buf, 150)
" clean up " clean up
exe buf .. "bw!" exe buf .. "bw!"
bw! bw!

View File

@@ -704,6 +704,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
1043,
/**/ /**/
1042, 1042,
/**/ /**/