Skip to content

Commit 20d161a

Browse files
committed
patch 9.0.1992: [security] segfault in exmode
Problem: segfault in exmode when redrawing Solution: skip gui_scroll when exmode_active Signed-off-by: Christian Brabandt <[email protected]>
1 parent 290b887 commit 20d161a

4 files changed

Lines changed: 15 additions & 0 deletions

File tree

src/gui.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4397,6 +4397,7 @@ gui_do_scrollbar(
43974397
* Scroll a window according to the values set in the globals
43984398
* "current_scrollbar" and "scrollbar_value".
43994399
* Return TRUE if the cursor in the current window moved or FALSE otherwise.
4400+
* may eventually cause a redraw using updateWindow
44004401
*/
44014402
int
44024403
gui_do_scroll(void)
@@ -4416,6 +4417,9 @@ gui_do_scroll(void)
44164417
if (wp == NULL)
44174418
// Couldn't find window
44184419
return FALSE;
4420+
// don't redraw, LineOffset and similar are not valid!
4421+
if (exmode_active)
4422+
return FALSE;
44194423

44204424
/*
44214425
* Compute number of lines to scroll. If zero, nothing to do.

src/testdir/crash/crash_scrollbar

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
" this goes to insert mode and presses key k_VerScrollbar which may cause a redraw in exmode, which used ot crash Vim
2+
norm o��X

src/testdir/test_crash.vim

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,12 @@ func Test_crash1()
7272
\ ' || echo "crash 8: [OK]" >> X_crash1_result.txt' .. "\<cr>")
7373
call TermWait(buf, 3000)
7474

75+
let file = 'crash/crash_scrollbar'
76+
let args = printf(cmn_args, vim, file)
77+
call term_sendkeys(buf, args ..
78+
\ ' && echo "crash 9: [OK]" >> X_crash1_result.txt' .. "\<cr>")
79+
call TermWait(buf, 1000)
80+
7581
" clean up
7682
exe buf .. "bw!"
7783

@@ -86,6 +92,7 @@ func Test_crash1()
8692
\ 'crash 6: [OK]',
8793
\ 'crash 7: [OK]',
8894
\ 'crash 8: [OK]',
95+
\ 'crash 9: [OK]',
8996
\ ]
9097

9198
call assert_equal(expected, getline(1, '$'))

src/version.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -704,6 +704,8 @@ static char *(features[]) =
704704

705705
static int included_patches[] =
706706
{ /* Add new patch number below this line */
707+
/**/
708+
1992,
707709
/**/
708710
1991,
709711
/**/

0 commit comments

Comments
 (0)