f5e8ebfed2
Resolves: CVE-2022-0261
95 lines
2.6 KiB
Diff
95 lines
2.6 KiB
Diff
diff --git a/src/ops.c b/src/ops.c
|
||
index d8e96ff..88992b6 100644
|
||
--- a/src/ops.c
|
||
+++ b/src/ops.c
|
||
@@ -534,22 +534,27 @@ block_insert(
|
||
if (b_insert)
|
||
{
|
||
off = (*mb_head_off)(oldp, oldp + offset + spaces);
|
||
+ spaces -= off;
|
||
+ count -= off;
|
||
}
|
||
else
|
||
{
|
||
- off = (*mb_off_next)(oldp, oldp + offset);
|
||
- offset += off;
|
||
+ // spaces fill the gap, the character that's at the edge moves
|
||
+ // right
|
||
+ off = (*mb_head_off)(oldp, oldp + offset);
|
||
+ offset -= off;
|
||
}
|
||
- spaces -= off;
|
||
- count -= off;
|
||
}
|
||
|
||
- newp = alloc(STRLEN(oldp) + s_len + count + 1);
|
||
+ // Make sure the allocated size matches what is actually copied below.
|
||
+ newp = alloc(STRLEN(oldp) + spaces + s_len
|
||
+ + (spaces > 0 && !bdp->is_short ? ts_val - spaces : 0)
|
||
+ + count + 1);
|
||
if (newp == NULL)
|
||
continue;
|
||
|
||
// copy up to shifted part
|
||
- mch_memmove(newp, oldp, (size_t)(offset));
|
||
+ mch_memmove(newp, oldp, (size_t)offset);
|
||
oldp += offset;
|
||
|
||
// insert pre-padding
|
||
@@ -560,14 +565,21 @@ block_insert(
|
||
mch_memmove(newp + startcol, s, (size_t)s_len);
|
||
offset += s_len;
|
||
|
||
- if (spaces && !bdp->is_short)
|
||
+ if (spaces > 0 && !bdp->is_short)
|
||
{
|
||
- // insert post-padding
|
||
- vim_memset(newp + offset + spaces, ' ', (size_t)(ts_val - spaces));
|
||
- // We're splitting a TAB, don't copy it.
|
||
- oldp++;
|
||
- // We allowed for that TAB, remember this now
|
||
- count++;
|
||
+ if (*oldp == TAB)
|
||
+ {
|
||
+ // insert post-padding
|
||
+ vim_memset(newp + offset + spaces, ' ',
|
||
+ (size_t)(ts_val - spaces));
|
||
+ // we're splitting a TAB, don't copy it
|
||
+ oldp++;
|
||
+ // We allowed for that TAB, remember this now
|
||
+ count++;
|
||
+ }
|
||
+ else
|
||
+ // Not a TAB, no extra spaces
|
||
+ count = spaces;
|
||
}
|
||
|
||
if (spaces > 0)
|
||
@@ -1574,7 +1586,7 @@ op_insert(oparg_T *oap, long count1)
|
||
oap->start_vcol = t;
|
||
}
|
||
else if (oap->op_type == OP_APPEND
|
||
- && oap->end.col + oap->end.coladd
|
||
+ && oap->start.col + oap->start.coladd
|
||
>= curbuf->b_op_start_orig.col
|
||
+ curbuf->b_op_start_orig.coladd)
|
||
{
|
||
diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
|
||
index 7c5f973..dc8e376 100644
|
||
--- a/src/testdir/test_visual.vim
|
||
+++ b/src/testdir/test_visual.vim
|
||
@@ -967,4 +967,13 @@ func Test_visual_put_in_block()
|
||
bwipe!
|
||
endfunc
|
||
|
||
+func Test_visual_block_append_invalid_char()
|
||
+ " this was going over the end of the line
|
||
+ new
|
||
+ call setline(1, [' let xxx', 'xxxxx', 'xxxxxxxxxxx'])
|
||
+ exe "normal 0\<C-V>jjA-\<Esc>"
|
||
+ call assert_equal([' - let xxx', 'xxxxx -', 'xxxxxxxx-xxx'], getline(1, 3))
|
||
+ bwipe!
|
||
+endfunc
|
||
+
|
||
" vim: shiftwidth=2 sts=2 expandtab
|