mirror of
https://github.com/neovim/neovim.git
synced 2025-09-06 03:18:16 +00:00
6af359ef4c
Problem: [security] use-after-free in tagstack_clear_entry
(Suyue Guo )
Solution: Instead of manually calling vim_free() on each of the tagstack
entries, let's use tagstack_clear_entry(), which will
also free the stack, but using the VIM_CLEAR macro,
which prevents a use-after-free by setting those pointers
to NULL
This addresses CVE-2024-41957
Github advisory:
https://github.com/vim/vim/security/advisories/GHSA-f9cr-gv85-hcr4
8a0bbe7b8a
Co-authored-by: Christian Brabandt <cb@256bit.org>
54 lines
1.3 KiB
Lua
54 lines
1.3 KiB
Lua
local t = require('test.testutil')
|
|
local n = require('test.functional.testnvim')()
|
|
|
|
local assert_alive = n.assert_alive
|
|
local clear = n.clear
|
|
local command = n.command
|
|
local eq = t.eq
|
|
local eval = n.eval
|
|
local exec = n.exec
|
|
local feed = n.feed
|
|
|
|
before_each(clear)
|
|
|
|
it('no crash when ending Visual mode while editing buffer closes window', function()
|
|
command('new')
|
|
command('autocmd ModeChanged v:n ++once close')
|
|
feed('v')
|
|
command('enew')
|
|
assert_alive()
|
|
end)
|
|
|
|
it('no crash when ending Visual mode close the window to switch to', function()
|
|
command('new')
|
|
command('autocmd ModeChanged v:n ++once only')
|
|
feed('v')
|
|
command('wincmd p')
|
|
assert_alive()
|
|
end)
|
|
|
|
it('no crash when truncating overlong message', function()
|
|
pcall(command, 'source test/old/testdir/crash/vim_msg_trunc_poc')
|
|
assert_alive()
|
|
end)
|
|
|
|
it('no crash with very long option error message', function()
|
|
pcall(command, 'source test/old/testdir/crash/poc_did_set_langmap')
|
|
assert_alive()
|
|
end)
|
|
|
|
it('no crash when closing window with tag in loclist', function()
|
|
exec([[
|
|
new
|
|
lexpr ['foo']
|
|
lopen
|
|
let g:qf_bufnr = bufnr()
|
|
lclose
|
|
call settagstack(1, #{items: [#{tagname: 'foo', from: [g:qf_bufnr, 1, 1, 0]}]})
|
|
]])
|
|
eq(1, eval('bufexists(g:qf_bufnr)'))
|
|
command('1close')
|
|
eq(0, eval('bufexists(g:qf_bufnr)'))
|
|
assert_alive()
|
|
end)
|