vim-patch:9.2.0738: ml_recover() may write beyond block buffer (#40446)

Browse Source

Problem:  A crafted swap file can cause an out-of-bounds write during
          recovery when the same block is referenced twice with
          different pe_page_count values (cipher-creator)
Solution: Check hp->bh_page_count against page_count after mf_get() and
          clamp page_count to the actual block size.

closes: vim/vim#20645

43939cf9eb

Co-authored-by: Christian Brabandt <cb@256bit.org>

...

This commit is contained in:

zeertzjq

2026-06-27 17:21:05 +08:00

committed by GitHub

parent 6a61c81e31

commit f3fbb3928c

3 changed files with 27 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

BIN

test/old/testdir/samples/recover-mismatch-pc.swp Normal file

Binary file not shown.