summaryrefslogtreecommitdiffstats
path: root/meta/recipes-support/vim/files/CVE-2021-3872.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta/recipes-support/vim/files/CVE-2021-3872.patch')
-rw-r--r--meta/recipes-support/vim/files/CVE-2021-3872.patch57
1 files changed, 0 insertions, 57 deletions
diff --git a/meta/recipes-support/vim/files/CVE-2021-3872.patch b/meta/recipes-support/vim/files/CVE-2021-3872.patch
deleted file mode 100644
index f0f30933fa..0000000000
--- a/meta/recipes-support/vim/files/CVE-2021-3872.patch
+++ /dev/null
@@ -1,57 +0,0 @@
1From 132d060ffbb9651f0d79bd0b6d80cab460235a99 Mon Sep 17 00:00:00 2001
2From: Bram Moolenaar <Bram@vim.org>
3Date: Fri, 12 Nov 2021 02:56:51 +0000
4Subject: [PATCH] patch 8.2.3487: illegal memory access if buffer name is very
5 long
6
7Problem: Illegal memory access if buffer name is very long.
8Solution: Make sure not to go over the end of the buffer.
9
10CVE: CVE-2021-3872
11
12Upstream-Status: Backport [https://github.com/vim/vim/commit/826bfe4bbd7594188e3d74d2539d9707b1c6a14b]
13
14Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
15---
16 src/drawscreen.c | 10 +++++-----
17 1 file changed, 5 insertions(+), 5 deletions(-)
18
19diff --git a/src/drawscreen.c b/src/drawscreen.c
20index 3a88ee979..9acb70552 100644
21--- a/src/drawscreen.c
22+++ b/src/drawscreen.c
23@@ -446,13 +446,13 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
24 *(p + len++) = ' ';
25 if (bt_help(wp->w_buffer))
26 {
27- STRCPY(p + len, _("[Help]"));
28+ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[Help]"));
29 len += (int)STRLEN(p + len);
30 }
31 #ifdef FEAT_QUICKFIX
32 if (wp->w_p_pvw)
33 {
34- STRCPY(p + len, _("[Preview]"));
35+ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[Preview]"));
36 len += (int)STRLEN(p + len);
37 }
38 #endif
39@@ -462,12 +462,12 @@ win_redr_status(win_T *wp, int ignore_pum UNUSED)
40 #endif
41 )
42 {
43- STRCPY(p + len, "[+]");
44- len += 3;
45+ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", "[+]");
46+ len += (int)STRLEN(p + len);
47 }
48 if (wp->w_buffer->b_p_ro)
49 {
50- STRCPY(p + len, _("[RO]"));
51+ vim_snprintf((char *)p + len, MAXPATHL - len, "%s", _("[RO]"));
52 len += (int)STRLEN(p + len);
53 }
54
55--
562.31.1
57