]> git.ipfire.org Git - thirdparty/vim.git/commit
patch 9.0.2149: [security]: use-after-free in exec_instructions() v9.0.2149
authorChristian Brabandt <cb@256bit.org>
Mon, 4 Dec 2023 21:52:23 +0000 (22:52 +0100)
committerChristian Brabandt <cb@256bit.org>
Mon, 4 Dec 2023 21:54:43 +0000 (22:54 +0100)
commit5dd41d4b6370b7b7d09d691f9252b3899c66102a
tree99bcf9a51f84ef73d003206c2d2960b51bd133b3
parent1e5d66408ef85c750a5af03bbf5cc19b5de7a6bc
patch 9.0.2149: [security]: use-after-free in exec_instructions()

Problem:  [security]: use-after-free in exec_instructions()
Solution: get tv pointer again

[security]: use-after-free in exec_instructions()

exec_instructions may access freed memory, if the GA_GROWS_FAILS()
re-allocates memory. When this happens, the typval tv may still point to
now already freed memory. So let's get that pointer again and compare it
with tv. If those two pointers differ, tv is now invalid and we have to
refresh the tv pointer.

closes: #13621

Signed-off-by: Christian Brabandt <cb@256bit.org>
src/testdir/crash/poc_uaf_exec_instructions [new file with mode: 0644]
src/testdir/test_crash.vim
src/version.c
src/vim9execute.c