From 748198f5bf3048c06993efe4b048a6e39e4b1658 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 17 Nov 2023 08:55:36 +0800 Subject: [PATCH 01/16] vim-patch:9.0.1854: test_crash1() fails on CI Problem: test_crash1() fails on CI Solution: don't run Screendump test, verify that it doesn't crash by running it through a shell command line, testing the exit value and concatenating success cmd using '&&' https://github.com/vim/vim/commit/db510ca8052884fd260f425025bacf44f6c92fa9 Co-authored-by: Christian Brabandt --- test/old/testdir/test_crash.vim | 42 ++++++++++++++++++++++++--------- 1 file changed, 31 insertions(+), 11 deletions(-) diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index 445fe8d5a7..eb3c0a37fb 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -6,20 +6,40 @@ CheckScreendump func Test_crash1() " The following used to crash Vim - let opts = #{wait_for_ruler: 0, rows: 20} - let args = ' -u NONE -i NONE -n -e -s -S ' - let buf = RunVimInTerminal(args .. ' crash/poc_huaf1', opts) - call VerifyScreenDump(buf, 'Test_crash_01', {}) + " let opts = #{wait_for_ruler: 0, rows: 20, cmd: 'sh'} + let opts = #{cmd: 'sh'} + let args = 'bash' + let vim = GetVimProg() + + let buf = RunVimInTerminal(args, opts) + + let file = 'crash/poc_huaf1' + let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'" + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args .. + \ ' && echo "crash 1: [OK]" >> X_crash1_result.txt' .. "\") + + let file = 'crash/poc_huaf2' + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args .. + \ ' && echo "crash 2: [OK]" >> X_crash1_result.txt' .. "\") + + let file = 'crash/poc_huaf3' + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args .. + \ ' && echo "crash 3: [OK]" >> X_crash1_result.txt' .. "\") + + call TermWait(buf, 50) + + " clean up exe buf .. "bw!" - let buf = RunVimInTerminal(args .. ' crash/poc_huaf2', opts) - call VerifyScreenDump(buf, 'Test_crash_01', {}) - exe buf .. "bw!" - - let buf = RunVimInTerminal(args .. ' crash/poc_huaf3', opts) - call VerifyScreenDump(buf, 'Test_crash_01', {}) - exe buf .. "bw!" + sp X_crash1_result.txt + call assert_equal(['crash 1: [OK]', 'crash 2: [OK]', 'crash 3: [OK]'], + \ getline(1, '$')) + bw! + call delete('X_crash1_result.txt') endfunc func Test_crash2() From a589156b4d3ea2dc72908b8773c42ad012929c64 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 17 Nov 2023 08:56:41 +0800 Subject: [PATCH 02/16] vim-patch:9.0.1857: [security] heap-use-after-free in is_qf_win() Problem: heap-use-after-free in is_qf_win() Solution: Check buffer is valid before accessing it https://github.com/vim/vim/commit/fc68299d436cf87453e432daa77b6d545df4d7ed Co-authored-by: Christian Brabandt --- src/nvim/main.c | 2 +- src/nvim/quickfix.c | 6 +---- test/old/testdir/crash/bt_quickfix_poc | 9 +++++++ test/old/testdir/test_crash.vim | 34 ++++++++++++++++++++------ 4 files changed, 38 insertions(+), 13 deletions(-) create mode 100644 test/old/testdir/crash/bt_quickfix_poc diff --git a/src/nvim/main.c b/src/nvim/main.c index 818a1313d7..5c0fc758b9 100644 --- a/src/nvim/main.c +++ b/src/nvim/main.c @@ -698,7 +698,7 @@ void getout(int exitval) for (const tabpage_T *tp = first_tabpage; tp != NULL; tp = next_tp) { next_tp = tp->tp_next; FOR_ALL_WINDOWS_IN_TAB(wp, tp) { - if (wp->w_buffer == NULL) { + if (wp->w_buffer == NULL || !buf_valid(wp->w_buffer)) { // Autocmd must have close the buffer already, skip. continue; } diff --git a/src/nvim/quickfix.c b/src/nvim/quickfix.c index 19b34b52b4..2ddee313a3 100644 --- a/src/nvim/quickfix.c +++ b/src/nvim/quickfix.c @@ -262,10 +262,8 @@ static const char *e_current_location_list_was_changed = #define IS_QF_LIST(qfl) ((qfl)->qfl_type == QFLT_QUICKFIX) #define IS_LL_LIST(qfl) ((qfl)->qfl_type == QFLT_LOCATION) -// // Return location list for window 'wp' // For location list window, return the referenced location list -// #define GET_LOC_LIST(wp) (IS_LL_WINDOW(wp) ? (wp)->w_llist_ref : (wp)->w_llist) // Macro to loop through all the items in a quickfix list @@ -3863,13 +3861,11 @@ static bool qf_win_pos_update(qf_info_T *qi, int old_qf_index) static int is_qf_win(const win_T *win, const qf_info_T *qi) FUNC_ATTR_NONNULL_ARG(2) FUNC_ATTR_PURE FUNC_ATTR_WARN_UNUSED_RESULT { - // // A window displaying the quickfix buffer will have the w_llist_ref field // set to NULL. // A window displaying a location list buffer will have the w_llist_ref // pointing to the location list. - // - if (bt_quickfix(win->w_buffer)) { + if (buf_valid(win->w_buffer) && bt_quickfix(win->w_buffer)) { if ((IS_QF_STACK(qi) && win->w_llist_ref == NULL) || (IS_LL_STACK(qi) && win->w_llist_ref == qi)) { return true; diff --git a/test/old/testdir/crash/bt_quickfix_poc b/test/old/testdir/crash/bt_quickfix_poc new file mode 100644 index 0000000000..bf02b4dcb8 --- /dev/null +++ b/test/old/testdir/crash/bt_quickfix_poc @@ -0,0 +1,9 @@ +comman!-narg=* Xexpr lex +auto BufReadPre * exe"sn" ..expand("") +fu Xautocmd_changelist() +cal writefile(['Xtestfile2:4:4'],'Xerr') + sil! edi Xerr +Xexpr 'Xtestfile:4:4' +endf +call Xautocmd_changelist() +call Xautocmd_changelist() \ No newline at end of file diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index eb3c0a37fb..516d991939 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -5,38 +5,58 @@ source screendump.vim CheckScreendump func Test_crash1() + if !executable('sh') + throw 'Skipped: sh not executable!' + endif " The following used to crash Vim - " let opts = #{wait_for_ruler: 0, rows: 20, cmd: 'sh'} let opts = #{cmd: 'sh'} - let args = 'bash' let vim = GetVimProg() - let buf = RunVimInTerminal(args, opts) + let buf = RunVimInTerminal('sh', opts) let file = 'crash/poc_huaf1' let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'" let args = printf(cmn_args, vim, file) call term_sendkeys(buf, args .. - \ ' && echo "crash 1: [OK]" >> X_crash1_result.txt' .. "\") + \ ' && echo "crash 1: [OK]" > X_crash1_result.txt' .. "\") + call TermWait(buf, 50) let file = 'crash/poc_huaf2' let args = printf(cmn_args, vim, file) call term_sendkeys(buf, args .. \ ' && echo "crash 2: [OK]" >> X_crash1_result.txt' .. "\") + call TermWait(buf, 50) let file = 'crash/poc_huaf3' let args = printf(cmn_args, vim, file) call term_sendkeys(buf, args .. \ ' && echo "crash 3: [OK]" >> X_crash1_result.txt' .. "\") + call TermWait(buf, 100) - call TermWait(buf, 50) + let file = 'crash/bt_quickfix_poc' + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args .. + \ ' && echo "crash 4: [OK]" >> X_crash1_result.txt' .. "\") + " clean up + call delete('Xerr') + + " This test takes a bit longer + call TermWait(buf, 200) " clean up + call delete('Xerr') exe buf .. "bw!" sp X_crash1_result.txt - call assert_equal(['crash 1: [OK]', 'crash 2: [OK]', 'crash 3: [OK]'], - \ getline(1, '$')) + + let expected = [ + \ 'crash 1: [OK]', + \ 'crash 2: [OK]', + \ 'crash 3: [OK]', + \ 'crash 4: [OK]', + \ ] + + call assert_equal(expected, getline(1, '$')) bw! call delete('X_crash1_result.txt') From 8dc72789cfad630c2f2da572916490a32d5155e6 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 17 Nov 2023 09:12:01 +0800 Subject: [PATCH 03/16] vim-patch:9.0.1858: [security] heap use after free in ins_compl_get_exp() Problem: heap use after free in ins_compl_get_exp() Solution: validate buffer before accessing it https://github.com/vim/vim/commit/ee9166eb3b41846661a39b662dc7ebe8b5e15139 Co-authored-by: Christian Brabandt --- src/nvim/insexpand.c | 2 +- test/old/testdir/crash/poc_tagfunc.vim | 6 ++++++ test/old/testdir/test_crash.vim | 10 ++++++++-- 3 files changed, 15 insertions(+), 3 deletions(-) create mode 100644 test/old/testdir/crash/poc_tagfunc.vim diff --git a/src/nvim/insexpand.c b/src/nvim/insexpand.c index 28d1c8216e..f565d5b9e8 100644 --- a/src/nvim/insexpand.c +++ b/src/nvim/insexpand.c @@ -3435,7 +3435,7 @@ static int ins_compl_get_exp(pos_T *ini) compl_started = true; } else { // Mark a buffer scanned when it has been scanned completely - if (type == 0 || type == CTRL_X_PATH_PATTERNS) { + if (buf_valid(st.ins_buf) && (type == 0 || type == CTRL_X_PATH_PATTERNS)) { assert(st.ins_buf); st.ins_buf->b_scanned = true; } diff --git a/test/old/testdir/crash/poc_tagfunc.vim b/test/old/testdir/crash/poc_tagfunc.vim new file mode 100644 index 0000000000..49d9b6f719 --- /dev/null +++ b/test/old/testdir/crash/poc_tagfunc.vim @@ -0,0 +1,6 @@ +fu Tagfunc(t,f,o) + bw +endf +set tagfunc=Tagfunc +n0 +sil0norm0i diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index 516d991939..27bf7b55d4 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -39,12 +39,17 @@ func Test_crash1() \ ' && echo "crash 4: [OK]" >> X_crash1_result.txt' .. "\") " clean up call delete('Xerr') - " This test takes a bit longer call TermWait(buf, 200) + let file = 'crash/poc_tagfunc.vim' + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args .. + \ ' || echo "crash 5: [OK]" >> X_crash1_result.txt' .. "\") + + call TermWait(buf, 100) + " clean up - call delete('Xerr') exe buf .. "bw!" sp X_crash1_result.txt @@ -54,6 +59,7 @@ func Test_crash1() \ 'crash 2: [OK]', \ 'crash 3: [OK]', \ 'crash 4: [OK]', + \ 'crash 5: [OK]', \ ] call assert_equal(expected, getline(1, '$')) From bbb363f4bcfb56f8e60afff5f6f65cfe9e860252 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 17 Nov 2023 09:15:38 +0800 Subject: [PATCH 04/16] vim-patch:partial:9.0.1859: heap-use-after-free in bt_normal() Problem: heap-use-after-free in bt_normal() Solution: check that buffer is still valid https://github.com/vim/vim/commit/6e60cf444a8839ca1694319bf9a82e7b097e5c4d Test change only. Co-authored-by: Christian Brabandt --- test/old/testdir/crash/bt_quickfix1_poc | 5 +++++ test/old/testdir/test_crash.vim | 10 ++++++++++ 2 files changed, 15 insertions(+) create mode 100644 test/old/testdir/crash/bt_quickfix1_poc diff --git a/test/old/testdir/crash/bt_quickfix1_poc b/test/old/testdir/crash/bt_quickfix1_poc new file mode 100644 index 0000000000..97993fde52 --- /dev/null +++ b/test/old/testdir/crash/bt_quickfix1_poc @@ -0,0 +1,5 @@ +au BufReadPre * exe 'sn' .. expand("") +call writefile([''],'X') +sil! e X +call writefile([''],'X') +sil! e X diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index 27bf7b55d4..8deb79702b 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -49,6 +49,15 @@ func Test_crash1() call TermWait(buf, 100) + let file = 'crash/bt_quickfix1_poc' + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args .. + \ ' && echo "crash 6: [OK]" >> X_crash1_result.txt' .. "\") + " clean up + call delete('X') + " This test takes a bit longer + call TermWait(buf, 200) + " clean up exe buf .. "bw!" @@ -60,6 +69,7 @@ func Test_crash1() \ 'crash 3: [OK]', \ 'crash 4: [OK]', \ 'crash 5: [OK]', + \ 'crash 6: [OK]', \ ] call assert_equal(expected, getline(1, '$')) From 2371b9303d6b724c0e8c057239d00575c96d51f6 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 17 Nov 2023 09:18:42 +0800 Subject: [PATCH 05/16] vim-patch:9.0.1860: CI: test_crash1() is flaky Problem: CI: test_crash1() is flaky Solution: Wait a bit longer https://github.com/vim/vim/commit/f44cbe96fa44d10d6dd717e0a9f6ef0f104ee98a Co-authored-by: Christian Brabandt --- test/old/testdir/test_crash.vim | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index 8deb79702b..b997cc1d29 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -40,7 +40,7 @@ func Test_crash1() " clean up call delete('Xerr') " This test takes a bit longer - call TermWait(buf, 200) + call TermWait(buf, 500) let file = 'crash/poc_tagfunc.vim' let args = printf(cmn_args, vim, file) @@ -55,7 +55,6 @@ func Test_crash1() \ ' && echo "crash 6: [OK]" >> X_crash1_result.txt' .. "\") " clean up call delete('X') - " This test takes a bit longer call TermWait(buf, 200) " clean up From 1274380029313d820c9a0c28d10d606ddb27aacd Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 17 Nov 2023 09:19:01 +0800 Subject: [PATCH 06/16] vim-patch:9.0.1864: still crash with bt_quickfix1_poc Problem: crash with bt_quickfix1_poc when cleaning up and EXITFREE is defined Solution: Test if buffer is valid in a window, else close window directly, don't try to access buffer properties While at it, increase the crash timeout slightly, so that CI has a chance to finish processing the test_crash() test. https://github.com/vim/vim/commit/623ba31821a41acee7e948794e84867680b97885 Co-authored-by: Christian Brabandt --- src/nvim/window.c | 6 ++++++ test/old/testdir/test_crash.vim | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/src/nvim/window.c b/src/nvim/window.c index 8ff8053118..89bdd7f5e0 100644 --- a/src/nvim/window.c +++ b/src/nvim/window.c @@ -3776,6 +3776,12 @@ void close_others(int message, int forceit) continue; } + // autoccommands messed this one up + if (!buf_valid(wp->w_buffer) && win_valid(wp)) { + wp->w_buffer = NULL; + win_close(wp, false, false); + continue; + } // Check if it's allowed to abandon this window int r = can_abandon(wp->w_buffer, forceit); if (!win_valid(wp)) { // autocommands messed wp up diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index b997cc1d29..8c79d3abd6 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -40,7 +40,7 @@ func Test_crash1() " clean up call delete('Xerr') " This test takes a bit longer - call TermWait(buf, 500) + call TermWait(buf, 1000) let file = 'crash/poc_tagfunc.vim' let args = printf(cmn_args, vim, file) @@ -55,7 +55,7 @@ func Test_crash1() \ ' && echo "crash 6: [OK]" >> X_crash1_result.txt' .. "\") " clean up call delete('X') - call TermWait(buf, 200) + call TermWait(buf, 1000) " clean up exe buf .. "bw!" From 0b0df9f5d7035a3ce90ea5c1bbd7737293a26414 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 17 Nov 2023 09:21:54 +0800 Subject: [PATCH 07/16] vim-patch:9.0.1868: test_crash still fails for circle ci Problem: test_crash still fails for circle ci Solution: give even more time to complete https://github.com/vim/vim/commit/59adcb4c203371258c72e76011da93eac8540317 Co-authored-by: Christian Brabandt --- test/old/testdir/test_crash.vim | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index 8c79d3abd6..781f810ef7 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -55,7 +55,7 @@ func Test_crash1() \ ' && echo "crash 6: [OK]" >> X_crash1_result.txt' .. "\") " clean up call delete('X') - call TermWait(buf, 1000) + call TermWait(buf, 3000) " clean up exe buf .. "bw!" From 6867d2492c1788dfab0a40d0fe453c4a3ce52e28 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 17 Nov 2023 09:22:09 +0800 Subject: [PATCH 08/16] vim-patch:9.0.1872: CI: test_crash() fails on CI Problem: CI: test_crash() fails on CI Solution: Skip test on BSD https://github.com/vim/vim/commit/d2a08ba0fa4a25f31cee9d9f33b0aa8237227387 Co-authored-by: Christian Brabandt --- test/old/testdir/test_crash.vim | 2 ++ 1 file changed, 2 insertions(+) diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index 781f810ef7..e0884e5a05 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -5,6 +5,8 @@ source screendump.vim CheckScreendump func Test_crash1() + CheckNotBSD + if !executable('sh') throw 'Skipped: sh not executable!' endif From eae10de14e8584b8c6c2b7b8255c8191b969698d Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 17 Nov 2023 09:22:30 +0800 Subject: [PATCH 09/16] vim-patch:9.0.1873: [security] heap-buffer-overflow in vim_regsub_both Problem: heap-buffer-overflow in vim_regsub_both Solution: Disallow exchanging windows when textlock is active https://github.com/vim/vim/commit/f6d28fe2c95c678cc3202cc5dc825a3fcc709e93 Cherry-pick test_crash.vim change from patch 9.0.1876. Co-authored-by: Christian Brabandt --- test/old/testdir/test_crash.vim | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index e0884e5a05..aa30684291 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -46,6 +46,7 @@ func Test_crash1() let file = 'crash/poc_tagfunc.vim' let args = printf(cmn_args, vim, file) + " using || because this poc causes vim to exit with exitstatus != 0 call term_sendkeys(buf, args .. \ ' || echo "crash 5: [OK]" >> X_crash1_result.txt' .. "\") @@ -59,6 +60,12 @@ func Test_crash1() call delete('X') call TermWait(buf, 3000) + let file = 'crash/vim_regsub_both_poc' + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args .. + \ ' && echo "crash 7: [OK]" >> X_crash1_result.txt' .. "\") + call TermWait(buf, 1000) + " clean up exe buf .. "bw!" @@ -71,6 +78,7 @@ func Test_crash1() \ 'crash 4: [OK]', \ 'crash 5: [OK]', \ 'crash 6: [OK]', + \ 'crash 7: [OK]', \ ] call assert_equal(expected, getline(1, '$')) From b5b6e6fb496df3dccf6f14f6f816b48b99dca000 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 17 Nov 2023 09:31:50 +0800 Subject: [PATCH 10/16] vim-patch:9.0.1878: tests running sh have problems Problem: tests running sh have problems Solution: Check that dash is installed closes: vim/vim#13040 https://github.com/vim/vim/commit/1690ec64ffd784cddddb937870f5891adbb21986 Co-authored-by: Philip H <47042125+pheiduck@users.noreply.github.com> Co-authored-by: Christian Brabandt --- test/old/testdir/test_crash.vim | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index aa30684291..b6ae4d2153 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -6,10 +6,8 @@ CheckScreendump func Test_crash1() CheckNotBSD + CheckExecutable dash - if !executable('sh') - throw 'Skipped: sh not executable!' - endif " The following used to crash Vim let opts = #{cmd: 'sh'} let vim = GetVimProg() @@ -64,7 +62,7 @@ func Test_crash1() let args = printf(cmn_args, vim, file) call term_sendkeys(buf, args .. \ ' && echo "crash 7: [OK]" >> X_crash1_result.txt' .. "\") - call TermWait(buf, 1000) + call TermWait(buf, 3000) " clean up exe buf .. "bw!" From 7f62775d5da3c67fe626f74ac7aad4e001428d3f Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 17 Nov 2023 09:32:13 +0800 Subject: [PATCH 11/16] vim-patch:9.0.1881: Test_crash fails on Mac Problem: Test_crash fails on Mac Solution: Skip test on Mac https://github.com/vim/vim/commit/5856b07795dff69e3bac57deb5033b5839c1dfb8 Co-authored-by: Christian Brabandt --- test/old/testdir/test_crash.vim | 2 ++ 1 file changed, 2 insertions(+) diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index b6ae4d2153..b841ccb052 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -7,6 +7,8 @@ CheckScreendump func Test_crash1() CheckNotBSD CheckExecutable dash + " Test 7 fails on Mac ... + CheckNotMac " The following used to crash Vim let opts = #{cmd: 'sh'} From 5a67878e8684e02caf853137aae1dc367a77b48f Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 17 Nov 2023 09:32:30 +0800 Subject: [PATCH 12/16] vim-patch:9.0.1882: Trailing white space in tests Problem: Trailing white space in tests Solution: Delete it This causes test_codestyle to fail, so we need to remove it again. Hopefully that makes the CI green again. Note: I will start using annotated tags from now on. https://github.com/vim/vim/commit/da200c2f78ef3c91557a2b484d284eb0c1c62776 Co-authored-by: Christian Brabandt --- test/old/testdir/test_crash.vim | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index b841ccb052..a1da68ed4c 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -7,7 +7,7 @@ CheckScreendump func Test_crash1() CheckNotBSD CheckExecutable dash - " Test 7 fails on Mac ... + " Test 7 fails on Mac ... CheckNotMac " The following used to crash Vim From 3ab0e296c674a6846512df24a0a70199bba8c59a Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 17 Nov 2023 09:33:54 +0800 Subject: [PATCH 13/16] vim-patch:9.0.1969: [security] buffer-overflow in trunc_string() Problem: buffer-overflow in trunc_string() Solution: Add NULL at end of buffer Currently trunc_string() assumes that when the string is too long, buf[e-1] will always be writeable. But that assumption may not always be true. The condition currently looks like this else if (e + 3 < buflen) [...] else { // can't fit in the "...", just truncate it buf[e - 1] = NUL; } but this means, we may run into the last else clause with e still being larger than buflen. So a buffer overflow occurs. So instead of using `buf[e - 1]`, let's just always truncate at `buf[buflen - 1]` which should always be writable. https://github.com/vim/vim/commit/3bd7fa12e146c6051490d048a4acbfba974eeb04 vim-patch:9.0.2004: Missing test file Problem: Missing test file Solution: git-add the file to the repo closes: vim/vim#13305 https://github.com/vim/vim/commit/d4afbdd0715c722cfc73d3a8ab9e578667615faa Co-authored-by: Christian Brabandt --- src/nvim/message.c | 2 +- test/functional/legacy/messages_spec.lua | 6 ++++++ test/old/testdir/crash/vim_msg_trunc_poc | 1 + test/old/testdir/test_crash.vim | 7 +++++++ 4 files changed, 15 insertions(+), 1 deletion(-) create mode 100644 test/old/testdir/crash/vim_msg_trunc_poc diff --git a/src/nvim/message.c b/src/nvim/message.c index 8be8581537..ee1a9e60b0 100644 --- a/src/nvim/message.c +++ b/src/nvim/message.c @@ -468,7 +468,7 @@ void trunc_string(const char *s, char *buf, int room_in, int buflen) buf[e + 3 + len - 1] = NUL; } else { // can't fit in the "...", just truncate it - buf[e - 1] = NUL; + buf[buflen - 1] = NUL; } } diff --git a/test/functional/legacy/messages_spec.lua b/test/functional/legacy/messages_spec.lua index a604e68822..7536506aa3 100644 --- a/test/functional/legacy/messages_spec.lua +++ b/test/functional/legacy/messages_spec.lua @@ -6,6 +6,7 @@ local exec = helpers.exec local feed = helpers.feed local meths = helpers.meths local nvim_dir = helpers.nvim_dir +local assert_alive = helpers.assert_alive before_each(clear) @@ -758,4 +759,9 @@ describe('messages', function() ]]) os.remove('b.txt') end) + + it('no crash when truncating overlong message', function() + pcall(command, 'source test/old/testdir/crash/vim_msg_trunc_poc') + assert_alive() + end) end) diff --git a/test/old/testdir/crash/vim_msg_trunc_poc b/test/old/testdir/crash/vim_msg_trunc_poc new file mode 100644 index 0000000000..73b04bec35 --- /dev/null +++ b/test/old/testdir/crash/vim_msg_trunc_poc @@ -0,0 +1 @@ +lv\ngggggi;norm:᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌󠁲᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌᠌ diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index a1da68ed4c..5c83e3a2f5 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -66,6 +66,12 @@ func Test_crash1() \ ' && echo "crash 7: [OK]" >> X_crash1_result.txt' .. "\") call TermWait(buf, 3000) + let file = 'crash/vim_msg_trunc_poc' + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args .. + \ ' || echo "crash 8: [OK]" >> X_crash1_result.txt' .. "\") + call TermWait(buf, 3000) + " clean up exe buf .. "bw!" @@ -79,6 +85,7 @@ func Test_crash1() \ 'crash 5: [OK]', \ 'crash 6: [OK]', \ 'crash 7: [OK]', + \ 'crash 8: [OK]', \ ] call assert_equal(expected, getline(1, '$')) From b6200fbdf2035b09abfc0f94fba9c432bc0b9245 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 17 Nov 2023 09:42:10 +0800 Subject: [PATCH 14/16] vim-patch:9.0.1992: [security] segfault in exmode Problem: segfault in exmode when redrawing Solution: skip gui_scroll when exmode_active https://github.com/vim/vim/commit/20d161ace307e28690229b68584f2d84556f8960 Co-authored-by: Christian Brabandt --- test/old/testdir/crash/crash_scrollbar | 2 ++ test/old/testdir/test_crash.vim | 7 +++++++ 2 files changed, 9 insertions(+) create mode 100644 test/old/testdir/crash/crash_scrollbar diff --git a/test/old/testdir/crash/crash_scrollbar b/test/old/testdir/crash/crash_scrollbar new file mode 100644 index 0000000000..1de5905228 --- /dev/null +++ b/test/old/testdir/crash/crash_scrollbar @@ -0,0 +1,2 @@ +" this goes to insert mode and presses key k_VerScrollbar which may cause a redraw in exmode, which used ot crash Vim +norm oX diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index 5c83e3a2f5..9a80340c28 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -72,6 +72,12 @@ func Test_crash1() \ ' || echo "crash 8: [OK]" >> X_crash1_result.txt' .. "\") call TermWait(buf, 3000) + let file = 'crash/crash_scrollbar' + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args .. + \ ' && echo "crash 9: [OK]" >> X_crash1_result.txt' .. "\") + call TermWait(buf, 1000) + " clean up exe buf .. "bw!" @@ -86,6 +92,7 @@ func Test_crash1() \ 'crash 6: [OK]', \ 'crash 7: [OK]', \ 'crash 8: [OK]', + \ 'crash 9: [OK]', \ ] call assert_equal(expected, getline(1, '$')) From d49be1cd2893ad583361ac058279a471ad7877e5 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 17 Nov 2023 09:42:59 +0800 Subject: [PATCH 15/16] vim-patch:9.0.2010: [security] use-after-free from buf_contents_changed() Problem: [security] use-after-free from buf_contents_changed() Solution: block autocommands https://github.com/vim/vim/commit/41e6f7d6ba67b61d911f9b1d76325cd79224753d Co-authored-by: Christian Brabandt --- src/nvim/buffer.c | 6 ++++++ test/old/testdir/crash/editing_arg_idx_POC_1 | Bin 0 -> 398 bytes test/old/testdir/test_crash.vim | 9 +++++++++ 3 files changed, 15 insertions(+) create mode 100644 test/old/testdir/crash/editing_arg_idx_POC_1 diff --git a/src/nvim/buffer.c b/src/nvim/buffer.c index 6617907f8f..6d5c7a1766 100644 --- a/src/nvim/buffer.c +++ b/src/nvim/buffer.c @@ -4223,6 +4223,10 @@ bool buf_contents_changed(buf_T *buf) aco_save_T aco; aucmd_prepbuf(&aco, newbuf); + // We don't want to trigger autocommands now, they may have nasty + // side-effects like wiping buffers + block_autocmds(); + if (ml_open(curbuf) == OK && readfile(buf->b_ffname, buf->b_fname, 0, 0, (linenr_T)MAXLNUM, @@ -4247,6 +4251,8 @@ bool buf_contents_changed(buf_T *buf) wipe_buffer(newbuf, false); } + unblock_autocmds(); + return differ; } diff --git a/test/old/testdir/crash/editing_arg_idx_POC_1 b/test/old/testdir/crash/editing_arg_idx_POC_1 new file mode 100644 index 0000000000000000000000000000000000000000..5d048d03405a31e268f30950dc11d9dc767103de GIT binary patch literal 398 zcmYe!&&^HDQ`F5%EK0Z4Qiw>cC@4~}$<0qGw#!Ma`2W8sz1WT`v9u&#!KpMYC^a!9 zpeR*AOChx)RjD{nNkLC9wW1&~FGWMiCNZfr%}z;Efh#RRAp)dB3j~sLQ{s~|67$ki zb25uF5{opsk`r?n%8N2fQqwYXQZ=I0BT7<>OVXeq3`(b^X>utjq^4vlM5GoKae> X_crash1_result.txt' .. "\") call TermWait(buf, 1000) + let file = 'crash/editing_arg_idx_POC_1' + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args .. + \ ' || echo "crash 10: [OK]" >> X_crash1_result.txt' .. "\") + call TermWait(buf, 1000) + call delete('Xerr') + call delete('@') + " clean up exe buf .. "bw!" @@ -93,6 +101,7 @@ func Test_crash1() \ 'crash 7: [OK]', \ 'crash 8: [OK]', \ 'crash 9: [OK]', + \ 'crash 10: [OK]', \ ] call assert_equal(expected, getline(1, '$')) From 790bd4d5858713e8503825892c7d08340d189370 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 17 Nov 2023 09:47:04 +0800 Subject: [PATCH 16/16] vim-patch:9.0.2106: [security]: Use-after-free in win_close() Problem: [security]: Use-after-free in win_close() Solution: Check window is valid, before accessing it If the current window structure is no longer valid (because a previous autocommand has already freed this window), fail and return before attempting to set win->w_closing variable. Add a test to trigger ASAN in CI https://github.com/vim/vim/commit/25aabc2b8ee1e19ced6f4da9d866cf9378fc4c5a Co-authored-by: Christian Brabandt --- src/nvim/window.c | 3 ++ test/old/testdir/crash/poc1 | Bin 0 -> 3264 bytes test/old/testdir/crash/poc_huaf1 | Bin 0 -> 1541 bytes test/old/testdir/crash/poc_huaf2 | Bin 0 -> 3238 bytes test/old/testdir/crash/poc_huaf3 | Bin 0 -> 4053 bytes test/old/testdir/crash/vim_regsub_both_poc | Bin 0 -> 244 bytes test/old/testdir/test_crash.vim | 33 +++++++++++++++++++++ 7 files changed, 36 insertions(+) create mode 100644 test/old/testdir/crash/poc1 create mode 100644 test/old/testdir/crash/poc_huaf1 create mode 100644 test/old/testdir/crash/poc_huaf2 create mode 100644 test/old/testdir/crash/poc_huaf3 create mode 100644 test/old/testdir/crash/vim_regsub_both_poc diff --git a/src/nvim/window.c b/src/nvim/window.c index 89bdd7f5e0..00524b2f56 100644 --- a/src/nvim/window.c +++ b/src/nvim/window.c @@ -2661,6 +2661,9 @@ int win_close(win_T *win, bool free_buf, bool force) reset_VIsual_and_resel(); // stop Visual mode other_buffer = true; + if (!win_valid(win)) { + return FAIL; + } win->w_closing = true; apply_autocmds(EVENT_BUFLEAVE, NULL, NULL, false, curbuf); if (!win_valid(win)) { diff --git a/test/old/testdir/crash/poc1 b/test/old/testdir/crash/poc1 new file mode 100644 index 0000000000000000000000000000000000000000..ec223f16b8803b676e4c47620190a77f13a18e93 GIT binary patch literal 3264 zcmd1H&&(|@FeuK;H;@nFYR$|s$jdLv%a`dlXfWU^E->H%1CT0%AOmrzN*%Du&pG96OWGILTjqSYfxQj1GKY$GcZD-(4q9rcLRq9S!oE(L|uluQK> zhYRc%^@z00oLOL1_`S-+@Slqz=^|IYz>h5;uwl!VE&D)>EnBvzsi|3A6ySNC7M`jo zARr*{4n!!FGp_E>iHULeZ0&8Sq?4LjEO7S0*|TS3Fu()>nba%+9*`yj0RfF)CwK(} zB)IYgSp9X>xson&DG2=V(^2PAVBpHjFUqw_6c7;L5fD@WsTc4?u(iMf0y>NW5GjE| z0RdhC0UnSZ>~?c<3O9(QbAt5of(QWtS%F{t0s;bj!C+7v9Q-jw!CRrkAhtn)L2(tA zK)!Ga0|Qr{n>SZUH%rc(oE)wc1#cs+6oq;Q5R0qC03;j8Rbt@5(8vImFycyePyNrB zs*sb%m6NBJlaZj~|IZ83;a_KU-f_=`) zDwfNtEjHU)OpG;$p|^)CoGU#Q8E~a^b167n6<|my;z}vv{?FC$zb2KDOW;3ODcAoA z|NnC}C^)42=PLb@{6B_~D}5GM5m!pL5m&f^w-LynTqOpva6k6Dc{4CFFmSbYv!r%{ z{b>pI4nv6nSGRd?|xfBF` z`01!~DKK#5XYBUK?- zMM2@eyaGD#25YZ%^DegGDo#}>t_@A;%INCqTG`d*D8-=5rOV(7_B<=AST3u!*lcSt zG1eT0-X5-SuJlx7z?IU?rQmQ?fFY%bE2ZfF|7{KbYf>4x1pafCa{Zt1|36oQf@r(r0lMaiw${afK^*8-e`GRbmhe@~aZaul;V`42%p6T&>+Kshwc|T7tdB zP@?}SUcsBIgn^+!!Mm(Fhd~h(EqX8E@9&yGYEafVIQ?3>)<*tK+d>Bwruma1XCi@ZtF%R$M=AXcHCL2;D;13Zf{Ffu?DGAv)dK_UIeayXd0eED*aMz8<_3zkBm zefjd`3=E76U=<`1Tfyp&gGnTUfq_8*iHq(g6shIQm#;z>z{Y3zk4+R+3|`Kmmu;xZ k$m6AB1AOU4R~Z;O!?}`*_%s-}exAL2HZCSL$2X@108>pEO#lD@ literal 0 HcmV?d00001 diff --git a/test/old/testdir/crash/poc_huaf2 b/test/old/testdir/crash/poc_huaf2 new file mode 100644 index 0000000000000000000000000000000000000000..4867e0f956bbb2a3621dac76fa5bdbdcd8fe789f GIT binary patch literal 3238 zcmZQ#_|L_Vbdf7x;Kvpa*sx{GmVF?`mMvS<)YPml3h=y63r|%P5D*Y}2O<>88CUn` z#Kbs!w)VDE(n(D%7C8Ih?Afz17+`{cOlp<@4@i@NfPluY6TAWf5?uKLto}OcTuB$X z6a;?w>8NulFmUDN7v)+d3J3`B2nZ^G)C>3`*jiu#0UbsGh?GE~fB>(601rqHcDp$_ zg&V}uIYIh(L4<&StiUgR0RaKNU@#~S4*r;;;H^+%5Zj=@pty=lAYV9zfq^T}&6}&F zn z(A&cm&Xt~u47gIdxfC3(3NWM;aitV-|L1D>Uz5tnCGelCly7AC@4Tm%_3;2Sz>@(_y%*8fQl-G zdIlo~E`j{zptv@ORj5ZTp&1w%pbEi?mM>q9r2=VRzI-_Y10zZ02rLt91vBuJ1k0B% zuP3pL0vm}=oPY^jgoB3vWiUZZdKsn=7Lh?yXwSytIJnT@DYW5ETE2X=&_)Uj>M=(P zZIqTDo|1)#HU=bGsM~rZr{G7f2e=y)NU9h9|8HR6D&cEd&Y}vA5%a$$sK#VP0wy3G8SzQ$1d7T!Xswf~JAn*=E zD3mjLTPo?KrWOmFeQ@^d*%%BkK|m%oOMpi}Ku5qpKtSWy30?sK39ftrR(~CJuB3}x z3Iad;bkw;N7`XECi*l_J1q1|m1Oyd8h70&2*jiu#0b@o1h?GE~fB>(608f5=t`&B> zIXQ(J#L_uI`glQvfPk#PFMa_50lr``C=L$(n4;jVP+}0fF ztE8JHXHHHISBiqS5m$;rJp+ivRbl{=4df~@@L*_U081EgrMjp7FG^L&$>Yk&)62<7 zRR~s5KnC7mZMAOR#Wq~UsS3rlp($M%U0q!(ySf~u7<9RG8C=0WXJr-3Wz`m&Z7n9o zn#0iB!xhezo{9{(Qo6Ym9Igs5q!e+b6mkFOYWQE1%E%?~pR1JX|Ahblxf&E4QvP$5 zeo6ix!^o9Bi>rt$rQ3)rT*2E2i93=9kc6dFOf z_FoJPzbH2aV#09{#oz!U!FVN@1QQGl4EA6KQN&^*RDFf0nF*#q6$1%%m;g2EFdd9K zY$O$j)F`*WQHP7zppgCpmmEy|6pS$>=+V-bdUe2P>5Gx%M@!$)9t0^p2#f@TEHL~^ zU$F1Cf=N<{6j0kXC{_X7wG?jS<9f%%O&X9yQ{JG!@c(}U16K+6yZ=30F{#!J?@^2t MKxst>gZrH+01Sij=N#jaR%z;WGm}Lt8>lyMG7#JD2ic`6Y z^YnUY?F&qs*Ce2EV#;wxeSVvi~eT_Fr=h%73XsS E04FR?Gynhq literal 0 HcmV?d00001 diff --git a/test/old/testdir/test_crash.vim b/test/old/testdir/test_crash.vim index 5cd07e2a3f..b093b053c5 100644 --- a/test/old/testdir/test_crash.vim +++ b/test/old/testdir/test_crash.vim @@ -110,6 +110,39 @@ func Test_crash1() call delete('X_crash1_result.txt') endfunc +func Test_crash1_2() + CheckNotBSD + CheckExecutable dash + + " The following used to crash Vim + let opts = #{cmd: 'sh'} + let vim = GetVimProg() + let result = 'X_crash1_1_result.txt' + + let buf = RunVimInTerminal('sh', opts) + + let file = 'crash/poc1' + let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'" + let args = printf(cmn_args, vim, file) + call term_sendkeys(buf, args .. + \ ' && echo "crash 1: [OK]" > '.. result .. "\") + call TermWait(buf, 150) + + " clean up + exe buf .. "bw!" + + exe "sp " .. result + + let expected = [ + \ 'crash 1: [OK]', + \ ] + + call assert_equal(expected, getline(1, '$')) + bw! + + call delete(result) +endfunc + func Test_crash2() " The following used to crash Vim let opts = #{wait_for_ruler: 0, rows: 20}