diff options
Diffstat (limited to 'patches/source/vim/CVE-2022-2817.patch')
-rw-r--r-- | patches/source/vim/CVE-2022-2817.patch | 69 |
1 files changed, 0 insertions, 69 deletions
diff --git a/patches/source/vim/CVE-2022-2817.patch b/patches/source/vim/CVE-2022-2817.patch deleted file mode 100644 index d9bfc1a66..000000000 --- a/patches/source/vim/CVE-2022-2817.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 249e1b903a9c0460d618f6dcc59aeb8c03b24b20 Mon Sep 17 00:00:00 2001 -From: Bram Moolenaar <Bram@vim.org> -Date: Sun, 14 Aug 2022 22:23:02 +0100 -Subject: [PATCH] patch 9.0.0213: using freed memory with error in assert - argument - -Problem: Using freed memory with error in assert argument. -Solution: Make a copy of the error. ---- - -diff --git a/src/testdir/test_assert.vim b/src/testdir/test_assert.vim -index 27b2d73fbfc8..7c9d090b39df 100644 ---- a/src/testdir/test_assert.vim -+++ b/src/testdir/test_assert.vim -@@ -291,6 +291,10 @@ func Test_assert_fail_fails() - let exp = v:exception - endtry - call assert_match("E1174: String required for argument 5", exp) -+ -+ call assert_equal(1, assert_fails('c0', ['', '\1'])) -+ call assert_match("Expected '\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors[0]) -+ call remove(v:errors, 0) - endfunc - - func Test_assert_fails_in_try_block() -diff --git a/src/testing.c b/src/testing.c -index f2355f5dac13..21eb9c18e6e2 100644 ---- a/src/testing.c -+++ b/src/testing.c -@@ -597,6 +597,7 @@ f_assert_fails(typval_T *argvars, typval_T *rettv) - int save_trylevel = trylevel; - int called_emsg_before = called_emsg; - char *wrong_arg_msg = NULL; -+ char_u *tofree = NULL; - - if (check_for_string_or_number_arg(argvars, 0) == FAIL - || check_for_opt_string_or_list_arg(argvars, 1) == FAIL -@@ -660,13 +661,17 @@ f_assert_fails(typval_T *argvars, typval_T *rettv) - } - else if (list->lv_len == 2) - { -- tv = &list->lv_u.mat.lv_last->li_tv; -- actual = get_vim_var_str(VV_ERRMSG); -- expected = tv_get_string_buf_chk(tv, buf); -- if (!pattern_match(expected, actual, FALSE)) -+ // make a copy, an error in pattern_match() may free it -+ tofree = actual = vim_strsave(get_vim_var_str(VV_ERRMSG)); -+ if (actual != NULL) - { -- error_found = TRUE; -- expected_str = expected; -+ tv = &list->lv_u.mat.lv_last->li_tv; -+ expected = tv_get_string_buf_chk(tv, buf); -+ if (!pattern_match(expected, actual, FALSE)) -+ { -+ error_found = TRUE; -+ expected_str = expected; -+ } - } - } - } -@@ -749,6 +754,7 @@ f_assert_fails(typval_T *argvars, typval_T *rettv) - msg_scrolled = 0; - lines_left = Rows; - VIM_CLEAR(emsg_assert_fails_msg); -+ vim_free(tofree); - set_vim_var_string(VV_ERRMSG, NULL, 0); - if (wrong_arg_msg != NULL) - emsg(_(wrong_arg_msg)); |