Skip to content

Commit

Permalink
patch 8.2.5043: can open a cmdline window from a substitute expression
Browse files Browse the repository at this point in the history
Problem:    Can open a cmdline window from a substitute expression.
Solution:   Disallow opening a command line window when text or buffer is
            locked.
  • Loading branch information
brammool committed May 30, 2022
1 parent 89b2558 commit 71223e2
Show file tree
Hide file tree
Showing 6 changed files with 51 additions and 12 deletions.
7 changes: 1 addition & 6 deletions src/buffer.c
Expand Up @@ -2407,12 +2407,7 @@ buflist_getfile(
if (buf == curbuf)
return OK;

if (text_locked())
{
text_locked_msg();
return FAIL;
}
if (curbuf_locked())
if (text_or_buf_locked())
return FAIL;

// altfpos may be changed by getfile(), get it now
Expand Down
19 changes: 19 additions & 0 deletions src/ex_getln.c
Expand Up @@ -2739,6 +2739,21 @@ get_text_locked_msg(void)
return e_not_allowed_to_change_text_or_change_window;
}

/*
* Check for text, window or buffer locked.
* Give an error message and return TRUE if something is locked.
*/
int
text_or_buf_locked(void)
{
if (text_locked())
{
text_locked_msg();
return TRUE;
}
return curbuf_locked();
}

/*
* Check if "curbuf_lock" or "allbuf_lock" is set and return TRUE when it is
* and give an error message.
Expand Down Expand Up @@ -4379,6 +4394,10 @@ open_cmdwin(void)
int save_KeyTyped;
#endif

// Can't do this when text or buffer is locked.
if (text_or_buf_locked())
return K_IGNORE;

// Can't do this recursively. Can't do it when typing a password.
if (cmdwin_type != 0
# if defined(FEAT_CRYPT) || defined(FEAT_EVAL)
Expand Down
5 changes: 3 additions & 2 deletions src/proto/ex_getln.pro
Expand Up @@ -3,9 +3,10 @@ void cmdline_init(void);
char_u *getcmdline(int firstc, long count, int indent, getline_opt_T do_concat);
char_u *getcmdline_prompt(int firstc, char_u *prompt, int attr, int xp_context, char_u *xp_arg);
int check_opt_wim(void);
int text_locked(void);
void text_locked_msg(void);
char *get_text_locked_msg(void);
int text_locked(void);
int text_or_buf_locked(void);
int curbuf_locked(void);
int allbuf_locked(void);
char_u *getexline(int c, void *cookie, int indent, getline_opt_T options);
Expand All @@ -32,8 +33,8 @@ cmdline_info_T *get_cmdline_info(void);
void f_getcmdcompltype(typval_T *argvars, typval_T *rettv);
void f_getcmdline(typval_T *argvars, typval_T *rettv);
void f_getcmdpos(typval_T *argvars, typval_T *rettv);
void f_setcmdpos(typval_T *argvars, typval_T *rettv);
void f_getcmdscreenpos(typval_T *argvars, typval_T *rettv);
void f_setcmdpos(typval_T *argvars, typval_T *rettv);
void f_getcmdtype(typval_T *argvars, typval_T *rettv);
int get_cmdline_firstc(void);
int get_list_range(char_u **str, int *num1, int *num2);
Expand Down
25 changes: 25 additions & 0 deletions src/testdir/test_substitute.vim
Expand Up @@ -1035,6 +1035,31 @@ func Test_sub_undo_change()
delfunc Repl
endfunc

" This was opening a command line window from the expression
func Test_sub_open_cmdline_win()
" the error only happens in a very specific setup, run a new Vim instance to
" get a clean starting point.
let lines =<< trim [SCRIPT]
norm o0000000000000000000000000000000000000000000000000000
func Replace()
norm q/
endfunc
s/\%')/\=Replace()
redir >Xresult
messages
redir END
qall!
[SCRIPT]
call writefile(lines, 'Xscript')
if RunVim([], [], '-u NONE -S Xscript')
let messages = readfile('Xresult')
call assert_match('E565: Not allowed to change text or change window', messages[3])
endif

call delete('Xscript')
call delete('Xresult')
endfunc

" Test for the 2-letter and 3-letter :substitute commands
func Test_substitute_short_cmd()
new
Expand Down
2 changes: 2 additions & 0 deletions src/version.c
Expand Up @@ -734,6 +734,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
/**/
5043,
/**/
5042,
/**/
Expand Down
5 changes: 1 addition & 4 deletions src/window.c
Expand Up @@ -4585,14 +4585,11 @@ win_goto(win_T *wp)
return;
}
#endif
if (text_locked())
if (text_or_buf_locked())
{
beep_flush();
text_locked_msg();
return;
}
if (curbuf_locked())
return;

if (wp->w_buffer != curbuf)
reset_VIsual_and_resel();
Expand Down

2 comments on commit 71223e2

@system-thoughts
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi, all.
why does this commit fix CVE-2022-1942?
According to https://huntr.dev/bounties/67ca4d3b-9175-43c1-925c-72a7091bc071/
There is a Heap-based Buffer Overflow in vim_regsub_both, this patch does not fix the heap-based-buffer overflow problem.
Does this commit fix the flaw exploit situation aka "open a command-line window from a substitute expression when a text or buffer is locked"?

@brammool
Copy link
Contributor Author

@brammool brammool commented on 71223e2 Jun 24, 2022 via email

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please sign in to comment.