diff options
Diffstat (limited to '')
| -rw-r--r-- | debian/patches/CVE-2022-0351.patch | 58 |
1 files changed, 58 insertions, 0 deletions
diff --git a/debian/patches/CVE-2022-0351.patch b/debian/patches/CVE-2022-0351.patch new file mode 100644 index 0000000..59d38ae --- /dev/null +++ b/debian/patches/CVE-2022-0351.patch @@ -0,0 +1,58 @@ +From: Markus Koschany <apo@debian.org> +Date: Sun, 23 Oct 2022 17:18:10 +0200 +Subject: CVE-2022-0351 + +Origin: https://github.com/vim/vim/commit/fe6fb267e6ee5c5da2f41889e4e0e0ac5bf4b89d +--- + src/eval.c | 10 ++++++++++ + src/testdir/test_eval_stuff.vim | 5 +++++ + 2 files changed, 15 insertions(+) + +diff --git a/src/eval.c b/src/eval.c +index 3f9db7d..00c73a6 100644 +--- a/src/eval.c ++++ b/src/eval.c +@@ -4159,6 +4159,7 @@ eval7( + char_u *start_leader, *end_leader; + int ret = OK; + char_u *alias; ++ static int recurse = 0; + + /* + * Initialise variable so that clear_tv() can't mistake this for a +@@ -4174,6 +4175,14 @@ eval7( + *arg = skipwhite(*arg + 1); + end_leader = *arg; + ++ // Limit recursion to 1000 levels. At least at 10000 we run out of stack ++ // and crash. ++ if (recurse == 1000) ++ { ++ return FAIL; ++ } ++ ++recurse; ++ + switch (**arg) + { + /* +@@ -4481,6 +4490,7 @@ eval7( + } + } + ++ --recurse; + return ret; + } + +diff --git a/src/testdir/test_eval_stuff.vim b/src/testdir/test_eval_stuff.vim +index f4b3598..6c48c48 100644 +--- a/src/testdir/test_eval_stuff.vim ++++ b/src/testdir/test_eval_stuff.vim +@@ -94,3 +94,8 @@ func Test_let_errmsg() + call assert_fails('let v:errmsg = []', 'E730:') + let v:errmsg = '' + endfunc ++ ++func Test_deep_recursion() ++ " this was running out of stack ++ call assert_fails("exe 'if ' . repeat('(', 1002)") ++endfunc |