[vim] 94/139: patch 7.4.1777 Problem: Newly added features can escape the sandbox. Solution: Add checks for restricted and secure. (Yasuhiro Matsumoto)

[James McCoy]

This is an automated email from the git hooks/post-receive script.

jamessan pushed a commit to branch debian/sid
in repository vim.

commit 3849992b16011e36a5cb5be4b127f843389b96fd
Author: Bram Moolenaar <Bram at vim.org>
Date:   Fri Apr 22 20:46:52 2016 +0200

    patch 7.4.1777
    Problem:    Newly added features can escape the sandbox.
    Solution:   Add checks for restricted and secure. (Yasuhiro Matsumoto)
---
 src/eval.c    | 8 ++++++--
 src/version.c | 2 ++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/eval.c b/src/eval.c
index e771291..146348d 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -10408,6 +10408,8 @@ f_ch_logfile(typval_T *argvars, typval_T *rettv UNUSED)
 f_ch_open(typval_T *argvars, typval_T *rettv)
 {
     rettv->v_type = VAR_CHANNEL;
+    if (check_restricted() || check_secure())
+	return;
     rettv->vval.v_channel = channel_open_func(argvars);
 }
 
@@ -15078,6 +15080,8 @@ f_job_setoptions(typval_T *argvars, typval_T *rettv UNUSED)
 f_job_start(typval_T *argvars, typval_T *rettv)
 {
     rettv->v_type = VAR_JOB;
+    if (check_restricted() || check_secure())
+	return;
     rettv->vval.v_job = job_start(argvars);
 }
 
@@ -16821,8 +16825,6 @@ check_connection(void)
 #endif
 
 #ifdef FEAT_CLIENTSERVER
-static void remote_common(typval_T *argvars, typval_T *rettv, int expr);
-
     static void
 remote_common(typval_T *argvars, typval_T *rettv, int expr)
 {
@@ -20683,6 +20685,8 @@ f_timer_start(typval_T *argvars, typval_T *rettv)
     char_u  *callback;
     dict_T  *dict;
 
+    if (check_secure())
+	return;
     if (argvars[2].v_type != VAR_UNKNOWN)
     {
 	if (argvars[2].v_type != VAR_DICT
diff --git a/src/version.c b/src/version.c
index 1c35576..34b5f4c 100644
--- a/src/version.c
+++ b/src/version.c
@@ -754,6 +754,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1777,
+/**/
     1776,
 /**/
     1775,

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-vim/vim.git