patch 9.1.0739: [security]: use-after-free in ex_getln.c
Commit:
https://github.com/vim/vim/commit/a6de28755ec3fcc86d1ed0b744f1b410a8e9702d
Author: John Marriott <basil...@internode.on.net>
Date: Sat Sep 21 11:39:02 2024 +0200
patch 9.1.0739: [security]: use-after-free in ex_getln.c
Problem: [security]: use-after-free in ex_getln.c
Solution: free pointer p a bit later (John Marriott)
closes: #15712
Signed-off-by: John Marriott <basil...@internode.on.net>
Signed-off-by: Christian Brabandt <c...@256bit.org>
diff --git a/src/ex_getln.c b/src/ex_getln.c
index 1b3a699a2..b4c794101 100644
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -3330,7 +3330,6 @@ realloc_cmdbuff(int len)
// there, thus copy up to the NUL and add a NUL.
mch_memmove(ccline.cmdbuff, p, (size_t)ccline.cmdlen);
ccline.cmdbuff[ccline.cmdlen] = NUL;
- vim_free(p);
if (ccline.xpc != NULL
&& ccline.xpc->xp_pattern != NULL
@@ -3345,6 +3344,8 @@ realloc_cmdbuff(int len)
ccline.xpc->xp_pattern = ccline.cmdbuff + i;
}
+ vim_free(p);
+
return OK;
}
diff --git a/src/version.c b/src/version.c
index ff2b77f0f..f4b755471 100644
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 739,
/**/
738,
/**/
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to vim_dev+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/vim_dev/E1srwfn-00EA8I-I3%40256bit.org.
