From 322ba9108612bead5eb7731ccb66763dec69ef1b Mon Sep 17 00:00:00 2001 From: Christian Brabandt Date: Sun, 25 Aug 2024 21:33:03 +0200 Subject: [PATCH] patch 9.1.0697: [security]: heap-buffer-overflow in ins_typebuf Problem: heap-buffer-overflow in ins_typebuf (SuyueGuo) Solution: When flushing the typeahead buffer, validate that there is enough space left Github Advisory: https://github.com/vim/vim/security/advisories/GHSA-4ghr-c62x-cqfh Signed-off-by: Christian Brabandt --- src/getchar.c | 15 ++++++++++++--- src/testdir/crash/heap_overflow3 | Bin 0 -> 700 bytes src/testdir/test_crash.vim | 7 +++++++ src/version.c | 2 ++ 4 files changed, 21 insertions(+), 3 deletions(-) create mode 100644 src/testdir/crash/heap_overflow3 diff --git a/src/getchar.c b/src/getchar.c index 29323fa328..96e180f4ae 100644 --- a/src/getchar.c +++ b/src/getchar.c @@ -446,9 +446,18 @@ flush_buffers(flush_buffers_T flush_typeahead) if (flush_typeahead == FLUSH_MINIMAL) { - // remove mapped characters at the start only - typebuf.tb_off += typebuf.tb_maplen; - typebuf.tb_len -= typebuf.tb_maplen; + // remove mapped characters at the start only, + // but only when enough space left in typebuf + if (typebuf.tb_off + typebuf.tb_maplen >= typebuf.tb_buflen) + { + typebuf.tb_off = MAXMAPLEN; + typebuf.tb_len = 0; + } + else + { + typebuf.tb_off += typebuf.tb_maplen; + typebuf.tb_len -= typebuf.tb_maplen; + } #if defined(FEAT_CLIENTSERVER) || defined(FEAT_EVAL) if (typebuf.tb_len == 0) typebuf_was_filled = FALSE; diff --git a/src/testdir/crash/heap_overflow3 b/src/testdir/crash/heap_overflow3 new file mode 100644 index 0000000000000000000000000000000000000000..c40adbec4d07a66bcc9aa51e40dbbb90fdc36623 GIT binary patch literal 700 zc-nQ4&ubGw6vro34?Zs*WGUn_LcAp8mlic`NE8jF#rPvslx9pjo0%j_HnVkS5^S<- z0yTK7(3?;x=&cuzJqi8=f*yM7KOs5Rb&{q~6+aBaeqE6yn!DP zpl(*yESu-NYvaF8%X;bMdFJ>=xP1NA!rVe8^V-ma2SE@N9j2_uE|(Ik2FIns%G1(A z+~k{BIk@TwWr;R#@jqnT*D@xcf$(8Nb-UnwAnO=^og%ryYE6_1i%XBF8;d2Ai^(KF z)I`YX|3gmV9Bf`eGYIV$BNG$+mg$e9tn?#OSDt&TDeaTi(d2xiMTI@KE@hcE70qS! z{tm{7ApT0OQ>jR7fSPI&=!R5q4m#GcULYp{PR4o6dRrSu5+@R7Ic1WtmqCcRdf?a% zsV^NQBtyV1wpZ?kkVap{{^w$322C_|5C2ci?oj0hXz>q zJovK#aHu}1HmJKsJJhmkoYYU4xLW@U;YLjY($VLr?-5V10_$nP`F!34ko4ER3jjks zDccs-%Qnv~L0nN&ZyeQw?5eJDuIhTZyS?@4+i*DS56_VN{&BRk8$vtpwzmdnvqyXT MUk>*4+h}z78%`AoZvX%Q literal 0 Hc-jL100001 diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim index f1843c4266..5ec103f6db 100644 --- a/src/testdir/test_crash.vim +++ b/src/testdir/test_crash.vim @@ -216,6 +216,13 @@ func Test_crash1_3() call term_sendkeys(buf, args) call TermWait(buf, 50) + let file = 'crash/heap_overflow3' + let cmn_args = "%s -u NONE -i NONE -n -X -m -n -e -s -S %s -c ':qa!'" + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args) + call TermWait(buf, 150) + + " clean up exe buf .. "bw!" bw! diff --git a/src/version.c b/src/version.c index b07964e2d7..7f88c8c683 100644 --- a/src/version.c +++ b/src/version.c @@ -704,6 +704,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 697, /**/ 696, /**/ -- 2.47.3