1 Star 0 Fork 53

AntsCodeCommunity/vim

forked from jiangpengjuj/vim 
加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
文件
该仓库未声明开源许可证文件(LICENSE),使用请关注具体项目描述及其代码上游依赖。
克隆/下载
backport-CVE-2022-3134.patch 2.21 KB
一键复制 编辑 原始数据 按行查看 历史
wjiang 提交于 2022-09-13 10:13 . fix CVE-2022-3134 CVE-2022-3153
From ccfde4d028e891a41e3548323c3d47b06fb0b83e Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Mon, 5 Sep 2022 19:51:13 +0100
Subject: [PATCH] patch 9.0.0389: crash when 'tagfunc' closes the window
Problem: Crash when 'tagfunc' closes the window.
Solution: Bail out when the window was closed.
---
src/errors.h | 2 ++
src/tag.c | 10 ++++++++++
src/testdir/test_tagfunc.vim | 12 ++++++++++++
3 files changed, 24 insertions(+)
diff --git a/src/errors.h b/src/errors.h
index 43a1c9b..bfb4ae8 100644
--- a/src/errors.h
+++ b/src/errors.h
@@ -3304,3 +3304,5 @@ EXTERN char e_could_not_check_for_pending_sigalrm_str[]
EXTERN char e_substitute_nesting_too_deep[]
INIT(= N_("E1290: substitute nesting too deep"));
#endif
+EXTERN char e_window_unexpectedly_close_while_searching_for_tags[]
+ INIT(= N_("E1299: Window unexpectedly closed while searching for tags"));
diff --git a/src/tag.c b/src/tag.c
index 8edb0c7..b4915cb 100644
--- a/src/tag.c
+++ b/src/tag.c
@@ -690,6 +690,16 @@ do_tag(
max_num_matches = MAXCOL; // If less than max_num_matches
// found: all matches found.
+ // A tag function may do anything, which may cause various
+ // information to become invalid. At least check for the tagstack
+ // to still be the same.
+ if (tagstack != curwin->w_tagstack)
+ {
+ emsg(_(e_window_unexpectedly_close_while_searching_for_tags));
+ FreeWild(new_num_matches, new_matches);
+ break;
+ }
+
// If there already were some matches for the same name, move them
// to the start. Avoids that the order changes when using
// ":tnext" and jumping to another file.
diff --git a/src/testdir/test_tagfunc.vim b/src/testdir/test_tagfunc.vim
index 9582612..c10a82d 100644
--- a/src/testdir/test_tagfunc.vim
+++ b/src/testdir/test_tagfunc.vim
@@ -401,4 +401,16 @@ func Test_tagfunc_wipes_buffer()
set tagfunc=
endfunc
+func Test_tagfunc_closes_window()
+ split any
+ func MytagfuncClose(pat, flags, info)
+ close
+ return [{'name' : 'mytag', 'filename' : 'Xtest', 'cmd' : '1'}]
+ endfunc
+ set tagfunc=MytagfuncClose
+ call assert_fails('tag xyz', 'E1299:')
+
+ set tagfunc=
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab
--
2.33.0
Loading...
马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化
1
https://gitee.com/AntsCodeCommunity/vim.git
git@gitee.com:AntsCodeCommunity/vim.git
AntsCodeCommunity
vim
vim
master

搜索帮助