thac0/vim
1
0
Fork 0
forked from aniani/vim
Code Activity

patch 9.0.1848: [security] buffer-overflow in vim_regsub_both()

Browse Source 
Problem:  buffer-overflow in vim_regsub_both()
Solution: Check remaining space

Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Christian Brabandt
2023-09-02 21:15:52 +02:00
parent 889f6af371
commit ced2c7394a
5 changed files with 27 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/regexp.c
View File

@@ -2051,7 +2051,8 @@ vim_regsub_both(
// "flags & REGSUB_COPY" != 0.
if (copy)
{
if (eval_result[nested] != NULL)
if (eval_result[nested] != NULL &&
STRLEN(eval_result[nested]) < destlen)
{
STRCPY(dest, eval_result[nested]);
dst += STRLEN(eval_result[nested]);