From 69a9a25fccd3e59f604888e2d9c29a822e14cca9 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Thu, 2 Oct 2025 07:50:00 +0800 Subject: [PATCH 1/3] vim-patch:9.1.0689: [security]: buffer-overflow in do_search() with 'rightleft' Problem: buffer-overflow in do_search() with 'rightleft' (SuyueGuo) Solution: after reversing the text (which allocates a new buffer), re-calculate the text length Github Advisory: https://github.com/vim/vim/security/advisories/GHSA-v2x2-cjcg-f9jm https://github.com/vim/vim/commit/cacb6693c10bb19f28a50eca47bc4bc33eccbae3 Add missing change from patch 8.1.1270. Omit `call delete('Untitled')`: moved again in patch 9.1.0695. Co-authored-by: Christian Brabandt --- src/nvim/search.c | 3 ++- test/old/testdir/crash/reverse_text_overflow | Bin 0 -> 314 bytes test/old/testdir/test_crash.vim | 8 ++++++++ 3 files changed, 10 insertions(+), 1 deletion(-) create mode 100644 test/old/testdir/crash/reverse_text_overflow diff --git a/src/nvim/search.c b/src/nvim/search.c index d2cbbec4c9..fe0bceef62 100644 --- a/src/nvim/search.c +++ b/src/nvim/search.c @@ -1282,9 +1282,10 @@ int do_search(oparg_T *oap, int dirc, int search_delim, char *pat, size_t patlen // it would be blanked out again very soon. Show it on the // left, but do reverse the text. if (curwin->w_p_rl && *curwin->w_p_rlc == 's') { - char *r = reverse_text(trunc != NULL ? trunc : msgbuf); + char *r = reverse_text(msgbuf); xfree(msgbuf); msgbuf = r; + msgbuflen = strlen(msgbuf); // move reversed text to beginning of buffer while (*r == ' ') { r++; diff --git a/test/old/testdir/crash/reverse_text_overflow b/test/old/testdir/crash/reverse_text_overflow new file mode 100644 index 0000000000000000000000000000000000000000..dfbfe2c9a611aad20c444aec335a11c9edf0ebf6 GIT binary patch literal 314 zcmXry<>lqo)Xd>3{;yD+%$b^>#;EYWI3vG2-%!U;y7q4gr=gA^mjYK(q5?yczCKq2 zE@01<*TBHQz?GMmT3nKvq7o=3CiYTWOw3hGOstG6!Ek;-Lk?GQD#()m^$aXr^$cPP zT*a9=sd*)edHF@T|4Z{q>vI@As*Q9E4dP-_{-^x+sCLjXG>nT$392^K(KQej78aHU zIhW_}q~g?)uuPDEzCN$MzP>(#0?6#59Im|lqK5w}AQ{~FBX3SBucoGET6A=ANwO{{ tCud+_AZJ-pE|;Sl%oq7Zxhg8Q5a6d0$iT?JASM9zOlGm1A+LgPJph6URf+%r literal 0 HcmV?d00001 diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index 9aef245026..834a0c014c 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -150,6 +150,13 @@ func Test_crash1_2() \ ' ; echo "crash 4: [OK]" >> '.. result .. "\") call TermWait(buf, 150) + let file = 'crash/reverse_text_overflow' + let cmn_args = "%s -u NONE -i NONE -n -X -m -n -e -s -S %s -c ':qa!'" + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args .. + \ ' ; echo "crash 5: [OK]" >> '.. result .. "\") + call TermWait(buf, 150) + " clean up exe buf .. "bw!" exe "sp " .. result @@ -158,6 +165,7 @@ func Test_crash1_2() \ 'crash 2: [OK]', \ 'crash 3: [OK]', \ 'crash 4: [OK]', + \ 'crash 5: [OK]', \ ] call assert_equal(expected, getline(1, '$')) From 71662bbb4903f0edb8e2b82f5f9765a89d833bf6 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Thu, 2 Oct 2025 07:55:27 +0800 Subject: [PATCH 2/3] vim-patch:9.1.0695: tests: test_crash leaves Untitled file around Problem: tests: test_crash leaves Untitled file around Solution: cleanup at the end of the test_crash.vim test file https://github.com/vim/vim/commit/cd83173defedc174d064d27a9db9fc190647b74c Co-authored-by: Christian Brabandt --- test/old/testdir/test_crash.vim | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index 834a0c014c..900bb9e40b 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -224,4 +224,11 @@ func Test_crash2() exe buf .. "bw!" endfunc +func Test_zz_cleanup() + " That file is created at Test_crash1_2() by dialog_changed_uaf + " but cleanup in that Test, doesn't remove it. Let's try again at + " the end of this test script + call delete('Untitled') +endfunc + " vim: shiftwidth=2 sts=2 expandtab From 532cc88604c66d8dea8b30a03bcf4db01fff392c Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Thu, 2 Oct 2025 07:55:44 +0800 Subject: [PATCH 3/3] vim-patch:9.1.0698: tests: "Untitled" file not removed when running Test_crash1_3 alone Problem: tests: "Untitled" file not removed when running Test_crash1_3 alone with TEST_FILTER (after v9.1.0695) Solution: Use a TearDown function instead of another test. (zeertzjq) closes: vim/vim#15578 closes: vim/vim#15577 https://github.com/vim/vim/commit/d56c451e1c05310562c5282352d7bb287c16323c --- test/old/testdir/test_crash.vim | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index 900bb9e40b..5ddbd07b55 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -224,9 +224,9 @@ func Test_crash2() exe buf .. "bw!" endfunc -func Test_zz_cleanup() - " That file is created at Test_crash1_2() by dialog_changed_uaf - " but cleanup in that Test, doesn't remove it. Let's try again at +func TearDown() + " That file is created at Test_crash1_3() by dialog_changed_uaf + " but cleaning up in that test doesn't remove it. Let's try again at " the end of this test script call delete('Untitled') endfunc