Vim Stack OOB Write in dump_prefixes() (9.2.0662)

漏洞概述 漏洞编号: 9.2.0662 漏洞类型: 栈溢出（Stack out-of-bounds write） 漏洞描述: 在 函数中，存在一个自引用的 节点，可能导致栈溢出。 影响范围 受影响文件: 受影响函数: 修复方案 修复方法: 在 函数中，增加深度检查，确保 不超过 。 修复代码: POC代码 测试文件: 测试代码: ```vim " A crafted .spl with a self-referential BY_INDEX node in the PREFIXTREE grove " dump_prefixes() past its MAXLEN-sized depth arrays (stack out-of-bounds " write). The tree parses cleanly (shared refs aren't recursed); the walk " happens on :spellump. Reaching the assert means no OOB. Same class as the " tree.count_words() fix (9.2.0659). func Test_spellump_prefixtree_overflow() CheckUnix call mkdir('Xrtp/spell', 'p') let Vimspell = v:os_prefix . 'xdo_SN_PREFIXON(prefix=1), SN_END, \ LWORDTREE word "a" with affixIdx=1 (no dump_prefixes runs), \ empty NARROWTREE_PREFIXTREE child BY_INDEX -> nodeidx 0 (self-cycle), 'A' \ let spl = eval('0x5649407376096C6C22030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

目標達成すべての支援者に感謝 — 100%達成しました！

Vim Stack OOB Write in dump_prefixes() (9.2.0662)

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

Vim Stack OOB Write in dump_prefixes() (9.2.0662)

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！