packages/utils/vim/patches/003-CVE-2019-12735.patch
Jan Pavlinec f2417d7198
vim: patch security issue
Fixes CVE-2019-12735

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
2019-06-06 15:54:55 +02:00

15 lines
395 B
Diff

--- a/src/getchar.c
+++ b/src/getchar.c
@@ -1407,6 +1407,12 @@ openscript(
emsg(_(e_nesting));
return;
}
+
+ // Disallow sourcing a file in the sandbox, the commands would be executed
+ // later, possibly outside of the sandbox.
+ if (check_secure())
+ return;
+
#ifdef FEAT_EVAL
if (ignore_script)
/* Not reading from script, also don't open one. Warning message? */