From d314229aa657bc23c0fc99aa79a347326095b190 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Wed, 8 May 2024 07:05:20 +0200 Subject: Adding debian version 2:8.1.0875-5+deb10u3. Signed-off-by: Daniel Baumann --- debian/patches/CVE-2022-0351.patch | 58 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 debian/patches/CVE-2022-0351.patch (limited to 'debian/patches/CVE-2022-0351.patch') diff --git a/debian/patches/CVE-2022-0351.patch b/debian/patches/CVE-2022-0351.patch new file mode 100644 index 0000000..59d38ae --- /dev/null +++ b/debian/patches/CVE-2022-0351.patch @@ -0,0 +1,58 @@ +From: Markus Koschany +Date: Sun, 23 Oct 2022 17:18:10 +0200 +Subject: CVE-2022-0351 + +Origin: https://github.com/vim/vim/commit/fe6fb267e6ee5c5da2f41889e4e0e0ac5bf4b89d +--- + src/eval.c | 10 ++++++++++ + src/testdir/test_eval_stuff.vim | 5 +++++ + 2 files changed, 15 insertions(+) + +diff --git a/src/eval.c b/src/eval.c +index 3f9db7d..00c73a6 100644 +--- a/src/eval.c ++++ b/src/eval.c +@@ -4159,6 +4159,7 @@ eval7( + char_u *start_leader, *end_leader; + int ret = OK; + char_u *alias; ++ static int recurse = 0; + + /* + * Initialise variable so that clear_tv() can't mistake this for a +@@ -4174,6 +4175,14 @@ eval7( + *arg = skipwhite(*arg + 1); + end_leader = *arg; + ++ // Limit recursion to 1000 levels. At least at 10000 we run out of stack ++ // and crash. ++ if (recurse == 1000) ++ { ++ return FAIL; ++ } ++ ++recurse; ++ + switch (**arg) + { + /* +@@ -4481,6 +4490,7 @@ eval7( + } + } + ++ --recurse; + return ret; + } + +diff --git a/src/testdir/test_eval_stuff.vim b/src/testdir/test_eval_stuff.vim +index f4b3598..6c48c48 100644 +--- a/src/testdir/test_eval_stuff.vim ++++ b/src/testdir/test_eval_stuff.vim +@@ -94,3 +94,8 @@ func Test_let_errmsg() + call assert_fails('let v:errmsg = []', 'E730:') + let v:errmsg = '' + endfunc ++ ++func Test_deep_recursion() ++ " this was running out of stack ++ call assert_fails("exe 'if ' . repeat('(', 1002)") ++endfunc -- cgit v1.2.3