1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
|
From: Markus Koschany <apo@debian.org>
Date: Wed, 19 Oct 2022 19:33:45 +0200
Subject: CVE-2021-3974
Origin: https://github.com/vim/vim/commit/64066b9acd9f8cffdf4840f797748f938a13f2d6
---
src/regexp.c | 2 +-
src/regexp_nfa.c | 8 ++++++++
src/testdir/test_regexp_latin.vim | 9 +++++++++
3 files changed, 18 insertions(+), 1 deletion(-)
--- a/src/regexp.c
+++ b/src/regexp.c
@@ -3474,7 +3474,7 @@ typedef struct {
// The current match-position is stord in these variables:
linenr_T lnum; // line number, relative to first line
char_u *line; // start of current line
- char_u *input; // current input, points into "regline"
+ char_u *input; // current input, points into "line"
int need_clear_subexpr; // subexpressions still need to be cleared
#ifdef FEAT_SYN_HL
--- a/src/regexp_nfa.c
+++ b/src/regexp_nfa.c
@@ -6570,8 +6570,16 @@ nfa_regmatch(
case NFA_MARK_GT:
case NFA_MARK_LT:
{
+ size_t col = rex.input - rex.line;
pos_T *pos = getmark_buf(rex.reg_buf, t->state->val, FALSE);
+ // Line may have been freed, get it again.
+ if (REG_MULTI)
+ {
+ rex.line = reg_getline(rex.lnum);
+ rex.input = rex.line + col;
+ }
+
/* Compare the mark position to the match position. */
result = (pos != NULL /* mark doesn't exist */
&& pos->lnum > 0 /* mark isn't set in reg_buf */
--- a/src/testdir/test_regexp_latin.vim
+++ b/src/testdir/test_regexp_latin.vim
@@ -84,3 +84,12 @@ func Test_multi_failure()
call assert_fails('/a\{a}', 'E870:')
set re=0
endfunc
+
+func Test_using_mark_position()
+ " this was using freed memory
+ new
+ norm O0
+ call assert_fails("s/\\%')", 'E486:')
+ bwipe!
+endfunc
+
|
