neovim

commit 6f167fcae9fb47f4b03e2b2ae6732540aa409454
parent 4ee65484b16da9c51e6e1fc3b0d31f74259894f4
Author: zeertzjq <zeertzjq@outlook.com>
Date:   Sun,  1 Sep 2024 05:07:17 +0800

vim-patch:9.1.0707: [security]: invalid cursor position may cause a crash (#30204)

Problem:  [security]: invalid cursor position may cause a crash
          (after v9.1.0038)
Solution: Set cursor to the last character in a line, if it would
          otherwise point to beyond the line; no tests added, as it
          is unclear how to reproduce this.

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-4ghr-c62x-cqfh

https://github.com/vim/vim/commit/396fd1ec2956307755392a1c61f55d5c1847f308

Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat:
M
src/nvim/plines.c
 | 
6
+++++-

1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/src/nvim/plines.c b/src/nvim/plines.c
@@ -516,7 +516,7 @@ static int virt_text_cursor_off(const CharsizeArg *csarg, bool on_NUL)
 void getvcol(win_T *wp, pos_T *pos, colnr_T *start, colnr_T *cursor, colnr_T *end)
 {
   char *const line = ml_get_buf(wp->w_buffer, pos->lnum);  // start of the line
-  int const end_col = pos->col;
+  colnr_T const end_col = pos->col;
 
   CharsizeArg csarg;
   bool on_NUL = false;
@@ -560,6 +560,10 @@ void getvcol(win_T *wp, pos_T *pos, colnr_T *start, colnr_T *cursor, colnr_T *en
     }
   }
 
+  if (*ci.ptr == NUL && end_col < MAXCOL && end_col > ci.ptr - line) {
+    pos->col = (colnr_T)(ci.ptr - line);
+  }
+
   int head = char_size.head;
   int incr = char_size.width;