blob: 23b8f916570b9b60a238926cb6f484363b0a3250 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
|
From: Markus Koschany <apo@debian.org>
Date: Mon, 24 Oct 2022 00:59:40 +0200
Subject: CVE-2022-0368
Origin: https://github.com/vim/vim/commit/8d02ce1ed75d008c34a5c9aaa51b67cbb9d33baa
---
src/testdir/test_visual.vim | 14 ++++++++++++++
src/undo.c | 2 ++
2 files changed, 16 insertions(+)
diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
index e361f97..1454877 100644
--- a/src/testdir/test_visual.vim
+++ b/src/testdir/test_visual.vim
@@ -428,3 +428,17 @@ func Test_visual_ex_copy_line()
bwipe!
endfunc
+" CVE-2022-0368
+func Test_visual_undo_deletes_last_line()
+ new
+ call setline(1, ["aaa", "ccc", "dyd"])
+ set undolevels=100
+ exe "normal obbbbbbbbbxbb\<Esc>"
+ set undolevels=100
+ /y
+ exe "normal ggvjfxO"
+ undo
+ normal gNU
+ bwipe!
+endfunc
+
diff --git a/src/undo.c b/src/undo.c
index 6b6dd47..6da9c1a 100644
--- a/src/undo.c
+++ b/src/undo.c
@@ -2965,6 +2965,8 @@ u_undo_end(
}
}
#endif
+ if (VIsual_active)
+ check_pos(curbuf, &VIsual);
smsg_attr_keep(0, _("%ld %s; %s #%ld %s"),
u_oldcount < 0 ? -u_oldcount : u_oldcount,
|
