thac0/vim
1
0
Fork 0
forked from aniani/vim
Code Activity

patch 9.1.0739: [security]: use-after-free in ex_getln.c

Browse Source 
Problem:  [security]: use-after-free in ex_getln.c
Solution: free pointer p a bit later (John Marriott)

closes: #15712

Signed-off-by: John Marriott <basilisk@internode.on.net>
Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
John Marriott
2024-09-21 11:39:02 +02:00
committed by Christian Brabandt
parent a0c14ef310
commit a6de28755e
2 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/ex_getln.c
View File

@@ -3330,7 +3330,6 @@ realloc_cmdbuff(int len)
// there, thus copy up to the NUL and add a NUL. // there, thus copy up to the NUL and add a NUL.
mch_memmove(ccline.cmdbuff, p, (size_t)ccline.cmdlen); mch_memmove(ccline.cmdbuff, p, (size_t)ccline.cmdlen);
ccline.cmdbuff[ccline.cmdlen] = NUL; ccline.cmdbuff[ccline.cmdlen] = NUL;
vim_free(p);
if (ccline.xpc != NULL if (ccline.xpc != NULL
&& ccline.xpc->xp_pattern != NULL && ccline.xpc->xp_pattern != NULL
@@ -3345,6 +3344,8 @@ realloc_cmdbuff(int len)
ccline.xpc->xp_pattern = ccline.cmdbuff + i; ccline.xpc->xp_pattern = ccline.cmdbuff + i;
} }
vim_free(p);
return OK; return OK;
} }

2
src/version.c
View File

@@ -704,6 +704,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
739,
/**/ /**/
738, 738,
/**/ /**/