blob: 90b1b6b82ee5e0ef28a2085d2e3b5d2d47349fde (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
|
From f334a87204b4aab76536063b37b4d4a10be46a3a Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Wed, 17 Nov 2021 11:09:48 +0800
Subject: [PATCH] patch 8.2.3581: reading character past end of line
Problem: Reading character past end of line.
Solution: Correct the cursor column.
CVE: CVE-2021-3927
Upstream-Status: Backport [https://github.com/vim/vim/commit/0b5b06cb4777d1401fdf83e7d48d287662236e7e]
Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
---
src/ex_docmd.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index 89d33ba90..54d7f4cb3 100644
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -6905,6 +6905,7 @@ ex_put(exarg_T *eap)
eap->forceit = TRUE;
}
curwin->w_cursor.lnum = eap->line2;
+ check_cursor_col();
do_put(eap->regname, eap->forceit ? BACKWARD : FORWARD, 1L,
PUT_LINE|PUT_CURSLINE);
}
--
2.17.1
|
