2 Star 0 Fork 53

openMajun/vim

forked from src-openEuler/vim 
加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
文件
该仓库未声明开源许可证文件(LICENSE),使用请关注具体项目描述及其代码上游依赖。
克隆/下载
backport-CVE-2021-3973.patch 2.28 KB
一键复制 编辑 原始数据 按行查看 历史
shixuantong 提交于 2021-11-30 15:56 . fix CVE-2021-3973 CVE-2021-3974
From 615ddd5342b50a6878a907062aa471740bd9a847 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Wed, 17 Nov 2021 18:00:31 +0000
Subject: [PATCH] patch 8.2.3611: crash when using CTRL-W f without finding a
file name
Problem: Crash when using CTRL-W f without finding a file name.
Solution: Bail out when the file name length is zero.
Reference:https://github.com/vim/vim/commit/615ddd5342b50a6878a907062aa471740bd9a847
---
src/findfile.c | 8 ++++++++
src/normal.c | 6 ++++--
src/testdir/test_visual.vim | 8 ++++++++
3 files changed, 20 insertions(+), 2 deletions(-)
diff --git a/src/findfile.c b/src/findfile.c
index ba996c4..7a4dfe5 100644
--- a/src/findfile.c
+++ b/src/findfile.c
@@ -1727,6 +1727,9 @@ find_file_in_path_option(
proc->pr_WindowPtr = (APTR)-1L;
# endif
+ if (len == 0)
+ return NULL;
+
if (first == TRUE)
{
// copy file name into NameBuff, expanding environment variables
@@ -2103,7 +2106,12 @@ find_file_name_in_path(
int c;
# if defined(FEAT_FIND_ID) && defined(FEAT_EVAL)
char_u *tofree = NULL;
+# endif
+ if (len == 0)
+ return NULL;
+
+# if defined(FEAT_FIND_ID) && defined(FEAT_EVAL)
if ((options & FNAME_INCL) && *curbuf->b_p_inex != NUL)
{
tofree = eval_includeexpr(ptr, len);
diff --git a/src/normal.c b/src/normal.c
index d6333b9..e9e587d 100644
--- a/src/normal.c
+++ b/src/normal.c
@@ -3778,8 +3778,10 @@ get_visual_text(
*pp = ml_get_pos(&VIsual);
*lenp = curwin->w_cursor.col - VIsual.col + 1;
}
- if (has_mbyte)
- // Correct the length to include the whole last character.
+ if (**pp == NUL)
+ *lenp = 0;
+ if (has_mbyte && *lenp > 0)
+ // Correct the length to include all bytes of the last character.
*lenp += (*mb_ptr2len)(*pp + (*lenp - 1)) - 1;
}
reset_VIsual_and_resel();
diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
index ae28123..0705fdb 100644
--- a/src/testdir/test_visual.vim
+++ b/src/testdir/test_visual.vim
@@ -894,4 +894,12 @@ func Test_block_insert_replace_tabs()
bwipe!
endfunc
+func Test_visual_block_ctrl_w_f()
+ " Emtpy block selected in new buffer should not result in an error.
+ au! BufNew foo sil norm f
+ edit foo
+
+ au! BufNew
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab
--
2.23.0
Loading...
马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化
1
https://gitee.com/openMajun/vim.git
git@gitee.com:openMajun/vim.git
openMajun
vim
vim
master

搜索帮助