Commit: patch 9.1.1043: [security]: segfault in win_line()

[Christian Brabandt]

patch 9.1.1043: [security]: segfault in win_line() Commit: https://github.com/vim/vim/commit/9d1bed5eccdbb46a26b8a484f5e9163c40e63919 Author: Christian Brabandt <c...@256bit.org> Date: Mon Jan 20 22:55:57 2025 +0100 patch 9.1.1043: [security]: segfault in win_line() Problem: [security]: segfault in win_line() (fizz-is-on-the-way) Solution: Check that ScreenLines is not NULL Github Advisory: https://github.com/vim/vim/security/advisories/GHSA-j3g9-wg22-v955 Signed-off-by: Christian Brabandt <c...@256bit.org> diff --git a/src/gui.c b/src/gui.c index 8e7b079a5..86c40de63 100644 --- a/src/gui.c +++ b/src/gui.c @@ -4478,13 +4478,15 @@ gui_do_scroll(void) /* * Don't call updateWindow() when nothing has changed (it will overwrite * the status line!). + * + * Check for ScreenLines, because in ex-mode, we don't have a valid display. */ - if (old_topline != wp->w_topline + if (ScreenLines != NULL && (old_topline != wp->w_topline || wp->w_redr_type != 0 #ifdef FEAT_DIFF || old_topfill != wp->w_topfill #endif ) )) { int type = UPD_VALID; diff --git a/src/testdir/crash/ex_redraw_crash b/src/testdir/crash/ex_redraw_crash new file mode 100644 index 000000000..eda294cae --- /dev/null +++ b/src/testdir/crash/ex_redraw_crash @@ -0,0 +1 @@ vi|gIv| diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim index bfd04ff10..c83ddf29e 100644 --- a/src/testdir/test_crash.vim +++ b/src/testdir/test_crash.vim @@ -234,6 +234,12 @@ func Test_crash1_3() call term_sendkeys(buf, args) call TermWait(buf, 50) + let file = 'crash/ex_redraw_crash' + let cmn_args = "%s -u NONE -i NONE -n -m -X -Z -e -s -S %s -c ':qa!'" + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args) + call TermWait(buf, 150) " clean up exe buf .. "bw!" bw! diff --git a/src/version.c b/src/version.c index 286cbec8c..7a2e5a803 100644 --- a/src/version.c +++ b/src/version.c @@ -704,6 +704,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 1043, /**/ 1042, /**/

[Marius Gedminas]

Mon, Jan 20, 2025 at 11:15:02PM +0100, Christian Brabandt rašė:
> patch 9.1.1043: [security]: segfault in win_line() Commit: https://github.com/vim/vim/commit/9d1bed5eccdbb46a26b8a484f5e9163c40e63919 Author: Christian Brabandt <c...@256bit.org> Date: Mon Jan 20 22:55:57 2025 +0100 patch 9.1.1043: [security]: segfault in win_line() Problem: [security]: segfault in win_line() (fizz-is-on-the-way) Solution: Check that ScreenLines is not NULL Github Advisory: https://github.com/vim/vim/security/advisories/GHSA-j3g9-wg22-v955 Signed-off-by: Christian Brabandt <c...@256bit.org> diff --git a/src/gui.c b/src/gui.c index 8e7b079a5..86c40de63 100644 --- a/src/gui.c +++ b/src/gui.c @@ -4478,13 +4478,15 @@ gui_do_scroll(void) /* * Don't call updateWindow() when nothing has changed (it will overwrite * the status line!). + * + * Check for ScreenLines, because in ex-mode, we don't have a valid display. */ - if (old_topline != wp->w_topline + if (ScreenLines != NULL && (old_topline != wp->w_topline || wp->w_redr_type != 0 #ifdef FEAT_DIFF || old_topfill != wp->w_topfill #endif ) )) { int type = UPD_VALID; diff --git a/src/testdir/crash/ex_redraw_crash b/src/testdir/crash/ex_redraw_crash new file mode 100644 index 000000000..eda294cae --- /dev/null +++ b/src/testdir/crash/ex_redraw_crash @@ -0,0 +1 @@ vi|gIv| diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim index bfd04ff10..c83ddf29e 100644 --- a/src/testdir/test_crash.vim +++ b/src/testdir/test_crash.vim @@ -234,6 +234,12 @@ func Test_crash1_3() call term_sendkeys(buf, args) call TermWait(buf, 50) + let file = 'crash/ex_redraw_crash' + let cmn_args = "%s -u NONE -i NONE -n -m -X -Z -e -s -S %s -c ':qa!'" + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args) + call TermWait(buf, 150) " clean up exe buf .. "bw!" bw! diff --git a/src/version.c b/src/version.c index 286cbec8c..7a2e5a803 100644 --- a/src/version.c +++ b/src/version.c @@ -704,6 +704,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 1043, /**/ 1042, /**/

Whoa, what happened here with the formatting?? The description and the
diff itself are all smushed up into one long line.

Marius Gedminas
--
If C gives you enough rope to hang yourself, C++ gives you enough rope to bind
and gag your neighborhood, rig the sails on a small ship, and still have enough
rope left over to hang yourself from the yardarm.