zeertzjq 69a9a25fcc vim-patch:9.1.0689: [security]: buffer-overflow in do_search() with 'rightleft' ...

Problem:  buffer-overflow in do_search() with 'rightleft'
          (SuyueGuo)
Solution: after reversing the text (which allocates a new buffer),
          re-calculate the text length

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-v2x2-cjcg-f9jm

cacb6693c1

Add missing change from patch 8.1.1270.
Omit `call delete('Untitled')`: moved again in patch 9.1.0695.

Co-authored-by: Christian Brabandt <cb@256bit.org>

2025-10-02 07:52:18 +08:00

..

bt_quickfix1_poc

vim-patch:partial:9.0.1859: heap-use-after-free in bt_normal()

2023-11-17 09:54:03 +08:00

bt_quickfix_poc

vim-patch:9.0.1857: [security] heap-use-after-free in is_qf_win()

2023-11-17 09:54:03 +08:00

crash_scrollbar

vim-patch:9.0.1992: [security] segfault in exmode

2023-11-17 09:59:22 +08:00

dialog_changed_uaf

vim-patch:9.1.0648: [security] double-free in dialog_changed()

2024-08-03 08:25:43 +08:00

double_free

vim-patch:9.1.0647: [security] use-after-free in tagstack_clear_entry

2024-08-02 07:14:42 +08:00

editing_arg_idx_POC_1

vim-patch:9.0.2010: [security] use-after-free from buf_contents_changed()

2023-11-17 09:59:22 +08:00

poc1

vim-patch:9.0.2106: [security]: Use-after-free in win_close()

2023-11-17 09:59:22 +08:00

poc_did_set_langmap

vim-patch:9.0.2142: [security]: stack-buffer-overflow in option callback functions

2023-12-02 10:41:31 +08:00

poc_ex_substitute

vim-patch:9.0.2143: [security]: buffer-overflow in ex_substitute

2023-12-02 10:41:31 +08:00

poc_huaf1

vim-patch:9.0.2106: [security]: Use-after-free in win_close()

2023-11-17 09:59:22 +08:00

poc_huaf2

vim-patch:9.0.2106: [security]: Use-after-free in win_close()

2023-11-17 09:59:22 +08:00

poc_huaf3

vim-patch:9.0.2106: [security]: Use-after-free in win_close()

2023-11-17 09:59:22 +08:00

poc_suggest_trie_walk

vim-patch:9.0.2141: [security]: buffer-overflow in suggest_trie_walk

2023-12-02 10:41:31 +08:00

poc_tagfunc.vim

vim-patch:9.0.1858: [security] heap use after free in ins_compl_get_exp()

2023-11-17 09:54:03 +08:00

poc_uaf_check_argument_types

vim-patch:9.0.2158: [security]: use-after-free in check_argument_type

2024-08-02 06:11:58 +08:00

poc_uaf_exec_instructions

vim-patch:9.0.2149: [security]: use-after-free in exec_instructions()

2024-08-02 06:11:58 +08:00

poc_win_enter_ext

vim-patch:9.0.2140: [security]: use-after-free in win-enter

2023-12-02 10:41:31 +08:00

reverse_text_overflow

vim-patch:9.1.0689: [security]: buffer-overflow in do_search() with 'rightleft'

2025-10-02 07:52:18 +08:00

vim_msg_trunc_poc

vim-patch:9.0.1969: [security] buffer-overflow in trunc_string()

2023-11-17 09:59:16 +08:00

vim_regsub_both

vim-patch:9.0.1848: [security] buffer-overflow in vim_regsub_both() (#25001)

2023-09-03 13:47:55 +08:00

vim_regsub_both_poc

vim-patch:9.0.2106: [security]: Use-after-free in win_close()

2023-11-17 09:59:22 +08:00