CVE-2022-2571: patch 9.0.0102: reading past end of line with insert mode completion · vim/vim@a6f9e30

Permalink

Browse files

patch 9.0.0102: reading past end of line with insert mode completion

Problem: Reading past end of line with insert mode completion. Solution: Check text length.

• Loading branch information

1 parent 4e677b9 commit a6f9e300161f4cb54713da22f65b261595e8e614

Showing 3 changed files with 11 additions and 1 deletion.

• • insexpand.c
  • • test_ins_complete.vim
  • version.c

@@ -3501,7 +3501,7 @@ ins_comp_get_next_word_or_line(

{

char_u *tmp_ptr = ptr;

if (compl_status_adding())

if (compl_status_adding() && compl_length <= (int)STRLEN(tmp_ptr))

{

tmp_ptr += compl_length;

// Skip if already inside a word.

@@ -2142,5 +2142,13 @@ func Test_ins_complete_add()

bwipe!

endfunc

func Test_ins_complete_end_of_line()

" this was reading past the end of the line

new

norm 8o€ý

sil! norm o

bwipe!

endfunc

" vim: shiftwidth=2 sts=2 expandtab

@@ -735,6 +735,8 @@ static char *(features[]) =

static int included_patches[] =

{ /* Add new patch number below this line */

/**/

102,

/**/

101,

/**/

0 comments on commit a6f9e30

Please sign in to comment.