Headline
CVE-2022-1616: patch 8.2.4895: buffer overflow with invalid command with composing c… · vim/vim@d889344
Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
Permalink
Browse files
patch 8.2.4895: buffer overflow with invalid command with composing c…
…hars
Problem: Buffer overflow with invalid command with composing chars. Solution: Check that the whole character fits in the buffer.
- Loading branch information
1 parent 5a7b6dc commit d88934406c5375d88f8f1b65331c9f0cab68cc6c
Showing with 16 additions and 1 deletion.
- +3 −1 src/ex_docmd.c
- +11 −0 src/testdir/test_cmdline.vim
- +2 −0 src/version.c
@@ -3435,14 +3435,16 @@ append_command(char_u *cmd)
STRCAT(IObuff, ": ");
d = IObuff + STRLEN(IObuff);
while (*s != NUL && d - IObuff < IOSIZE - 7)
while (*s != NUL && d - IObuff + 5 < IOSIZE)
{
if (enc_utf8 ? (s[0] == 0xc2 && s[1] == 0xa0) : *s == 0xa0)
{
s += enc_utf8 ? 2 : 1;
STRCPY(d, “<a0>”);
d += 4;
}
else if (d - IObuff + (*mb_ptr2len)(s) + 1 >= IOSIZE)
break;
else
MB_COPY_CHAR(s, d);
}
@@ -3353,6 +3353,17 @@ func Test_cmdline_complete_scriptnames()
set wildmenu&
endfunc
" this was going over the end of IObuff
func Test_report_error_with_composing()
let caught = ‘no’
try
exe repeat('0’, 987) … “0\xdd\x80\xdd\x80\xdd\x80\xdd\x80”
catch /E492:/
let caught = ‘yes’
endtry
call assert_equal('yes’, caught)
endfunc
" Test for expanding 2-letter and 3-letter :substitute command arguments.
" These commands don’t accept an argument.
func Test_cmdline_complete_substitute_short()
@@ -746,6 +746,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
4895,
/**/
4894,
/**/
0 comments on commit d889344
Please sign in to comment.
Related news
Gentoo Linux Security Advisory 202305-16 - Multiple vulnerabilities have been found in Vim, the worst of which could result in denial of service. Versions less than 9.0.1157 are affected.
Dell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability. A local high-privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the container's underlying OS. Exploitation may lead to a system take over by an attacker.
Hello everyone! Great news for my open source Scanvus project! You can now perform vulnerability checks on Linux hosts and docker images not only using the Vulners.com API, but also with the Vulns.io VM API. It’s especially nice that all the code to support the new API was written and contributed by colleagues from Vulns.io. […]
A memory corruption issue existed in the processing of ICC profiles. This issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13. Processing a maliciously crafted image may lead to arbitrary code execution.
Ubuntu Security Notice 5613-2 - USN-5613-1 fixed vulnerabilities in Vim. Unfortunately that update failed to include binary packages for some architectures. This update fixes that regression. It was discovered that Vim was not properly performing bounds checks when executing spell suggestion commands. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. It was discovered that Vim was using freed memory when dealing with regular expressions through its old regular expression engine. If a user were tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution. It was discovered that Vim was not properly performing checks on name of lambda functions. An attacker could possibly use this issue to cause a denial of service. This issue affected only Ubuntu 22.04 LTS. It was discovered that Vim was incorrectly performing bounds checks when processing invalid...
Ubuntu Security Notice 5613-1 - It was discovered that Vim was not properly performing bounds checks when executing spell suggestion commands. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. It was discovered that Vim was using freed memory when dealing with regular expressions through its old regular expression engine. If a user were tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution.
Gentoo Linux Security Advisory 202208-32 - Multiple vulnerabilities have been discovered in Vim, the worst of which could result in denial of service. Versions less than 9.0.0060 are affected.
Ubuntu Security Notice 5460-1 - It was discovered that Vim was incorrectly processing Vim buffers. An attacker could possibly use this issue to perform illegal memory access and expose sensitive information. It was discovered that Vim was not properly performing bounds checks for column numbers when replacing tabs with spaces or spaces with tabs, which could cause a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.