Problem: [security]: a crafted spell file can drive tree_count_words()
past the end of its MAXWLEN-sized depth arrays; the descent
loop has no depth bound.
Solution: only descend while depth < MAXWLEN - 1, as the sibling trie
walkers already do; apply the same guard to sug_filltree().
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq
Supported by AI.
a80874d9b8
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: filetype: tf files sometimes incorrectly recognized
(Christian Robinson)
Solution: Add support for g;filetype_tf variable to override detection,
re-write the filetype detection loop
closes: vim/vim#20510
Supported by AI
522a39a489
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: When a candidate gets truncated to MATCH_MAX_LEN and ends up
the same length as the needle, the n == m shortcut would
return SCORE_MAX with positions 0..n-1, even if the strings
actually differ.
Solution: Only use the shortcut if the truncated strings are truly equal.
Otherwise, fall back to regular matching.
Example:
echo matchfuzzypos(['x' .. repeat('a',1024)], repeat('a',1024))
closes: vim/vim#204751437f47815
Co-authored-by: glepnir <glephunter@gmail.com>
Problem: Problem with initializing the length of range() lists
Solution: Set length explicitly when it shouldn't contain any items
range() may cause a wrong calculation of list length, which may later
then cause a segfault in list_find(). This is usually not a problem,
because range_list_materialize() calculates the length, when it
materializes the list.
In addition, in list_find() when the length of the range was wrongly
initialized, it may seem to be valid, so the check for list index
out-of-bounds will not be true, because it is called before the list is
actually materialized. And so we may eventually try to access a null
pointer, causing a segfault.
So this patch does 3 things:
- In f_range(), when we know that the list should be empty, explicitly
set the list->lv_len value to zero. This should happen, when
start is larger than end (in case the stride is positive) or
end is larger than start when the stride is negative.
This should fix the underlying issue properly. However,
- as a safety measure, let's check that the requested index is not
out of range one more time, after the list has been materialized
and return NULL in case it suddenly is.
- add a few more tests to verify the behaviour.
fixes: vim/vim#13557closes: vim/vim#13563
--------
Vim9 (non) materialize list is N/A.
Port only tests.
df63da98d8
Co-authored-by: Christian Brabandt <cb@256bit.org>
Co-authored-by: Tim Pope <tpope@github.com>
Problem: statusline: buffer overflow with item groups
Solution: Fix the issues (see below) (Sébastien Hoffmann)
Fix various buffer overflow bugs (examples assume MAXPATHL==4096):
- truncated item groups where minwid>maxwid:
vim --clean +"set ls=2 stl=%<%{%repeat('x',4096-11)%}%50.5(12🙂345%)"
leads to fillchars spilling over the end of the group/buffer while trying to
compensate for truncating at a multicell character because minwid<=maxwid is assumed
- left-aligned item groups with multi-byte fillchar:
vim --clean +"set ls=2 fillchars+=stl:∙ stl=%<%{%repeat('x',4096-3)%}%-2(X%)"
wrongly leads to padding at the end of the statusline and `p-out==4097`
because the bounds check assumes a 1-byte fillchar
- right-aligned item groups with 1-byte fillchar:
vim --clean +"set ls=2 stl=%<%{%repeat('x',4096-4)%}%4(XY%)"
leads to "YX" instead of "XY" at the end of the statusline
because `memmove` is done before adjusting the offset
- right-aligned item groups with multi-byte fillchar:
vim --clean +"set ls=2 fillchars+=stl:∙ stl=%5(X%)"
leads to "∙∙∙∙<e2>", i.e. the fillchar is being written over the group contents
and eventually being overwritten itself at the second byte with the final NUL,
because the padding counter assumes a 1-byte fillchar; to crash vim,
vim --clean +"set ls=2 fillchars+=stl:∙ stl=%<%{%repeat('x',4096-149)%}%50(X%)"
related: neovim/neovim#40219
closes: vim/vim#20522d249884340
Co-authored-by: Sébastien Hoffmann <contact@shoffmann.dev>
Problem: Composing chars are no longer accepted in end-id abbreviation
(after 9.2.0629).
Solution: Unescape all chars using vim_unescape_csi() instead of using
mb_unescape() on individual chars, so that mb_ptr2len() and
MB_PTR_ADV() can still be used.
closes: vim/vim#2051423a84d28a8
Problem: 0x80 and 0x9b byte not unescaped when checking for valid abbr
(Mao-Yining)
Solution: Use mb_unescape() (zeertzjq).
fixes: vim/vim#20506closes: vim/vim#205081958c991a8
Problem: Keys valid in CTRL-X mode are never mapped while insert
completion is active, so <C-N> and <C-P> cannot be remapped
for completion started by complete().
Solution: Do not disable mappings in CTRL_X_EVAL mode. In this mode a
mapping cannot interfere with selecting the completion
method, which is what the no-mapping rule exists for.
related: vim/vim#6440
related: vim/vim#16880
closes: vim/vim#20489076585e6ad
Co-authored-by: Thomas M Kehrenberg <tmke8@posteo.net>
Problem: Deciding whether a group is in a "contains"/cluster list scans
the list and expands clusters on every check, which is slow for
syntaxes with large lists (e.g. plugins such as netrw).
Solution: Resolve each list once into a sorted, cluster-expanded set of
group IDs and use a binary search; cache it per syntax block and
drop the cache when syntax definitions change (Hirohito Higashi).
closes: vim/vim#2049048fbae4378
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Problem: The "%" command jumps to parens and braces inside comments,
unlike the "=" operator (cindent), which ignores them.
Solution: When 'comments' defines C-style comments and "%" is not in
'cpoptions', skip matching parens inside such comments, except
when the cursor is inside a comment so a match there can still
be found.
fixes: vim/vim#20329
related: vim/vim#20111
closes: vim/vim#20491b8a109dcfb
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem: gq (and other filters) on an empty buffer fail with
"E20: Mark not set": when the filter produces no output,
do_filter() still subtracts the line count from '[ and '],
pushing '] to line 0.
Solution: when the filter produces no output, put '[ and '] on a valid
line instead of subtracting past line 1 (glepnir).
related: neovim/neovim#30593
closes: vim/vim#19061aefbca2977
Problem: 'autoindent' not stripped with virtualedit=onemore (after
9.2.0510).
Solution: Restore the decrement of cursor column when it's on NUL.
fixes: neovim/neovim#40183closes: vim/vim#204764b13277edd
Problem: tests: test_codestyle does not notice lines containing only a
tab
Solution: Fix the whitespace issue in eval.txt, update test_codestyle to
notice such issues (Hirohito Higashi)
closes: vim/vim#185955b5290ec02
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Problem: tests: test_cmdline.vim leaves swapfiles behind
Solution: Close open buffers using :bw! instead of :close!
bf1b41e387
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: tests: test_sort.vim leaves swapfiles behind
Solution: Close open buffers using :bw! instead of :close!
f8c550fea0
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: tests: test_registers fails when not run under X11
Solution: filter out warning message
b2a8df35e8
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: unmarking a regular file when there are directories in the markings
list also removes the 2match highlight from those directories.
Solution: correctly rebuild the match pattern from the remaining markings,
using the right regex trailer for each entry in the list.
closes: vim/vim#20461affd4b5964
Co-authored-by: J. Paulo Seibt <jpseibt@gmail.com>
Problem:
* 'shellcmdflag' states that its default value is set according to the
value of 'shell', but this behavior is not yet implemented on Windows.
The same applies to 'shellpipe', 'shellredir', and 'shellxquote'.
* On Windows, Git is often installed in paths containing spaces, and we
still do not correctly resolve the sh executable name as described in
'shell'.
* On Windows, the default value of 'shellslash' is always `false`,
which causes Unix-like shells to interpret `\` in paths returned by
some functions as escape charaters.
Solution:
Use a simple rule table to detect common shells (e.g. `cmd`,
`powershell`, shells whose names contain `csh` or `sh`) and apply
best-effort defaults, while leaving more complex scenarios to user
configuration.
Problem: style: Various lines are indented inconsistently
Solution: Retab these lines and correct some comments.
(zeertzjq)
closes: vim/vim#15259d9be94cf03
Problem: tests: test_restricted() fails
(after: v9.1.0091)
Solution: Add a space before the pipecmd and the actual Vim command to
run
52eb0b8677
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: test_channel may fail because of IPv6 config issues
Solution: Catch and skip the test, if getaddrinfo() fails with
'Address family not supported'
Mark tests as skipped when ch_open encounters E901
On some of the Debian build systems, the IPv6 channel tests fail because
`ch_open('[::1]:<port>', ...)` raises the error "E901: getaddrinfo() in
channel_open(): Address family for hostname not supported".
This appears to happen because getaddrinfo() can't perform the reverse
lookup for the ::1, which is a config issue on that system. Therefore,
instead of reporting a test failure, mark the test as skipped due to the
bad network config
closes: vim/vim#1347343cb8e1c3b
Co-authored-by: James McCoy <jamessan@jamessan.com>
Problem: Test_screenpos() fails intermittently in the GUI testgui CI
job with "Expected {'row': 22} but got {'row': 23}". In the
GUI, the window height reported by getwininfo() before the
final redraw can be stale, so the cached wininfo.height does
not match the actual window height when the assertion runs.
Solution: Use winheight(winid) at assertion time so the height reflects
the window state after the redraw.
closes: vim/vim#20457781a91ac54
Co-authored-by: thinca <thinca@gmail.com>
Problem: A '}' inside a // line comment changes the indentation of the
following line inside an enum or struct (rendcrx).
Solution: Stop scanning the line once a line comment is reached, so a brace
inside the comment is no longer mistaken for an unmatched brace.
fixes: vim/vim#20455closes: vim/vim#204589dd86dff9b
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem: In command-line completion with a popup menu ('wildoptions'
contains "pum"), the info popup shown next to the menu could
not be scrolled, unlike the Insert mode completion info popup
which scrolls with the mouse wheel.
Solution: When the mouse pointer is on top of the info popup, scroll it
with the mouse wheel in command-line mode as well, without
closing the completion popup menu.
closes: vim/vim#20146closes: vim/vim#2041896dbab257a
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem: A needle that only matches past char 1024 gives an INT_MIN + 1
score with unset positions, e.g.
matchfuzzypos([repeat('a',1024)..'z'], 'az').
Solution: Drop the candidate when match_positions() returns SCORE_MIN.
closes: vim/vim#2043552003f7fc1
Problem: Test_statusline() occasionally fails in CI, reading buffer text
instead of the status line (e.g. '9012...' instead of '57,39').
Solution: In s:get_statusline() redraw unconditionally and read the screen
cells directly with screenstring(), instead of relying on
ScreenLines() whose own redraw! can process events and change the
window layout between the redraw and reading the cells. This
matches the already-stable s:Assert_match_statusline() helper in
test_statuslineopt.vim.
closes: vim/vim#20428db3ce018b5
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem: [security]: another possible code execution with python complete
(David Carliez)
Solution: Strip default expressions and annotations from generated
source for pythoncomplete and python3complete.
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468c8c63673bc
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: srolljump=-100 only scrolls half a page going up, but works
fine going down. update_topline() always falls back to
scroll_cursor_halfway() when the cursor is far above topline.
Solution: Only center when sj is smaller than half the window. Otherwise
call scroll_cursor_top like the downward path does (glepnir).
fixes: vim/vim#1527closes: vim/vim#20366a4a60c0fdb
Problem: After maximizing and deleting the quickfix buffer, window
height is wrong (tertium)
Solution: Reset the winfixheight option when a quickfix buffer is
deleted from a window (Yegappan Lakshmanan)
fixes: vim/vim#3378closes: vim/vim#2040307f055f579
Co-authored-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Problem: Deleting a quickfix line and undoing it leaves the entry
pointing one line below where it should.
Solution: Don't shift already cleared entries in qf_mark_adjust.
closes: vim/vim#2037964982d6010
Problem: Indent is not stripped in whole-line completion (CTRL-X
CTRL-L).
Solution: Skip the matched line's indent for whole-line matches in
search_for_fuzzy_match (glepnir).
closes: vim/vim#204059fa5f64135
Problem: Several Vim9 keywords lack EX_WHOLE and can be shortened in
Vim9 script, inconsistent with endif/enddef/endfor/endwhile/
endtry which already have it. The error from :endd in a
nested function also hardcodes "enddef" instead of reporting
what the user typed. fullcommand("ho") returns "horizontal"
even though :ho is below the documented 3-char minimum.
Solution: Add EX_WHOLE to :class, :def, :endclass, :endinterface,
:endenum, :public and :static. In get_function_body() pass
the user-typed command to the error message. Force :ho to
CMD_SIZE in find_ex_command() so fullcommand() reflects the
modifier minimum. Extend tests and documentation accordingly
(Peter Kenny).
fixes: vim/vim#20032closes: vim/vim#2019138d9a16eba
Co-authored-by: Peter Kenny <github.com@k1w1.cyou>
Problem: tests: filetype test for v9.2.0557 can be improved
Solution: Use a correct Kawasaki robot AS test file
(Patrick Meiser-Knosowski)
related: vim/vim#20370
closes: vim/vim#203870878792046
Co-authored-by: Patrick Meiser-Knosowski <knosowski@graeffrobotics.de>
Problem: The security patch 9.2.0561 added a vim.eval() call inside
Completer.evalsource() to honor g:pythoncomplete_allow_import.
But the 'vim' module is only imported inside the outer
vimcomplete() / vimpy3complete() function, not at the script's
top level, so referring to it from a Completer method raises
NameError. The surrounding bare 'except' silently swallows
the error and leaves allow_imports at 0, meaning the opt-in
never takes effect -- 'import os' (and any other
buffer-level import) is always skipped, no candidates are
produced for 'os.<...>' and
Test_popup_and_preview_autocommand() fails on the Windows
CI matrix (Linux skips the test because Python 2 is absent).
Solution: Re-import 'vim' at the top of evalsource() in both
pythoncomplete.vim and python3complete.vim so the eval reads
the global, and set g:pythoncomplete_allow_import = 1 in the
test (it is the opt-in intended for callers that trust the
buffer contents) (thinca).
closes: vim/vim#20386868ad62cb8
Co-authored-by: thinca <thinca@gmail.com>
Problem: If got_int is true when win_close() is called, it unexpectedly
fails in the branch that detects failure in apply_autocmds().
This causes wingotofile in do_window() to duplicate current
window when do_ecmd() is aborted with got_int.
Solution: Fix do_window() to save the got_int value before trying to
close the split window (Yohei Kojima).
Steps to reproduce:
1. run `touch a && touch .a.swp && echo a > b && vim b`
2. Type `<C-w>f`
3. In the warning dialogue, type `a` to abort
4. Current window is duplicated
closes: vim/vim#20382113e507cdd
Co-authored-by: Yohei Kojima <yk@y-koj.net>
Problem: filetype: Kawasaki Robots files are not recognized
Solution: Detect *.pg as kawasaki_as filetype, add filetype detection
for *.as as atlas or kawasaki_as filetype (KnoP-01).
In Kawasaki robots (https://kawasakirobotics.com/products-robots/)
AS language
*.pg is the extention for a program file and
*.as is for a complete backup.
closes: vim/vim#20370dec3d6c7da
Co-authored-by: KnoP-01 <knosowski@graeffrobotics.de>
Problem: cursor lands on the wrong line when a <Cmd> mapping or autocmd
modifies lines during insert and the strip is skipped
(after v9.2.0510)
Solution: Restore cursor to tpos when skipwhite skips the strip, instead
of leaving it at end_insert_pos (glepnir).
related: vim/vim#20290
closes: vim/vim#20332179f9efc7e
Co-authored-by: glepnir <glephunter@gmail.com>
Problem: The "%v" item in 'errorformat' interprets the reported
screen column using the buffer's 'tabstop', so the cursor
jumps to the wrong column when 'tabstop' is not 8
(vimpostor).
Solution: When resolving a "%v" column, always count a <tab> as 8
screen columns, independent of 'tabstop', matching the
column numbers reported by compilers; keep the multi-byte
handling. Also use "%v" in the gcc compiler file and
update the documentation (Hirohito Higashi).
fixes: vim/vim#20321closes: vim/vim#2035944dcad20f2
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: vimpostor <21310755+vimpostor@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Problem: filetype: too many Bitbake include files are recognized
(Brahmajit Das, after v9.1.1732)
Solution: Tighten the pattern to detect BitBake include files, update
tests (Martin Schwan).
Be more strict when detecting BitBake inc files. In particular, only
match include keywords and variable assignments at the beginning of a
line (excluding whitespace).
Use non-capturing groups to slightly improve performance.
Use regex or-operators to exactly match BitBake assignment operators.
The previous expression would falsely match
FOO .=. "bar"
, which is not valid BitBake syntax. The new capturing group is more
specific and matches only valid assignments.
fixes: vim/vim#20288closes: vim/vim#203352df68c8e4b
Co-authored-by: Martin Schwan <m.schwan@phytec.de>
Problem: A leading space in the result of a %{} item is sometimes
stripped, and an all-digit result is converted to a number.
Solution: Add %0{} atom which inserts the expression result verbatim
(glepnir)
fixes: vim/vim#3898closes: vim/vim#20315e8d7a40b98
Co-authored-by: glepnir <glephunter@gmail.com>
Problem: tests: matchit plugin is not tested
Solution: Add test_plugin_matchit, improve b:match_words for the html
filetype plugin (Andrey Starodubtsev)
`b:match_words` which contains patterns used by `matchit` plugin to find
tag's counterpath, is fixed so that matching happens using the whole
tag, not just its first letter.
Also, it allows to find matching tag in case if there are spaces or
attributes after tag name.
fixes: chrisbra/matchit#51closes: vim/vim#203133a90b2ba8e
Co-authored-by: Andrey Starodubtsev <andrey.starodubtsev@gmail.com>
