Problem: [security]: heap-buffer-overflow with visual mode when
using :all, causing Vim trying to access beyond end-of-line
(gandalf)
Solution: Reset visual mode on :all, validate position in gchar_pos()
and charwise_block_prep()
This fixes CVE-2025-22134
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-5rgf-26wj-48v8c9a1e257f1
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: exclusive selection not respected when re-selecting block mode
(Matt Ellis)
Solution: advance selection by another character when using
selection=exclusive and visual block mode
fixes: vim/vim#16202closes: vim/vim#16219bb95589473
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: Code style is not check in test scripts.
Solution: Add basic code style check for test files.
94722c5107
Use Test_test_files() from latest Vim.
Co-authored-by: Bram Moolenaar <Bram@vim.org>
Problem: block_editing errors out when using <enter>
(Ali Rizvi-Santiago, after v9.1.0274)
Solution: Change ins_len from size_t to int so that the test
if ins_len is negative actually works properly
Add a test, so that this doesn't regress.
fixes: vim/vim#149601fb9eae579
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: getregionpos() behaves inconsistently for a partly-selected
multibyte char.
Solution: Always use column of the first byte for a partly-selected
multibyte char (zeertzjq).
closes: vim/vim#14851ef73374dc3
Problem: Can't use a blockwise selection with a width for getregion().
Solution: Add support for blockwise selection with width like the return
value of getregtype() or the "regtype" value of TextYankPost
(zeertzjq).
closes: vim/vim#14842afc2295c22
Problem: getregionpos() can't properly indicate positions beyond eol.
Solution: Add an "eol" flag that enables handling positions beyond end
of line like getpos() does (zeertzjq).
Also fix the problem that a position still has the coladd beyond the end
of the line when its column has been clamped. In the last test case
with TABs at the end of the line the old behavior is obviously wrong.
I decided to gate this behind a flag because returning positions that
don't correspond to actual characters in the line may lead to mistakes
for callers that want to calculate the length of the selected text, so
the behavior is only enabled if the caller wants it.
closes: vim/vim#148382b09de9104
Problem: Wrong yanking with exclusive selection and virtualedit=all,
and integer overflow when using getregion() on it.
Solution: Set coladd when decreasing column and 'virtualedit' is active.
Add more tests for getregion() with 'virtualedit' (zeertzjq).
closes: vim/vim#14830701ad50a9e
Problem: getregionpos() doesn't handle one char selection.
Solution: Handle startspaces differently when is_oneChar is set.
Also add a test for an exclusive charwise selection with
multibyte chars (zeertzjq)
closes: vim/vim#1482552a6f34887
Problem: block_editing errors out when using del
(@Jamarley)
Solution: Change ins_len from size_t to int and
properly check that it doesn't become negative
There is a check in os.c that verifies that `ins_len` does not become
negative:
```
if (pre_textlen >= 0 && (ins_len = len - pre_textlen - offset) > 0)
```
However this only works, if ins_len can actually become negative and
unfortunately, ins_len has been declared as `size_t` so instead of
becoming negative it will wrap around and be very large.
So let's define it as integer, after which the condition above
properly catches this condition.
fixes: vim/vim#14734closes: vim/vim#14735d5c8c0920e
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: getregionpos() wrong with blockwise mode and multibyte.
Solution: Use textcol and textlen instead of start_vcol and end_vcol.
Handle coladd properly (zeertzjq).
Also remove unnecessary buflist_findnr() in add_regionpos_range(), as
getregionpos() has already switched buffer.
closes: vim/vim#14805c95e64f41f
Problem: Cannot get a list of positions describing a region
(Justin M. Keyes, after v9.1.0120)
Solution: Add the getregionpos() function
(Shougo Matsushita)
fixes: vim/vim#14609closes: vim/vim#14617b4757e627e
Co-authored-by: Shougo Matsushita <Shougo.Matsu@gmail.com>
Co-authored-by: Justin M. Keyes <justinkz@gmail.com>
Problem: cursor() and getregion() don't handle v:maxcol well.
Solution: Add special handling for v:maxcol like setpos() does.
(zeertzjq)
closes: vim/vim#146982ffdae7948
Problem: Internal error with blockwise getregion() in another buffer
Solution: Also change curwin->w_buffer when changing curbuf (zeertzjq)
closes: vim/vim#141795406eb8722
Problem: Internal error or crash when passing invalid position to
getregion().
Solution: Give an error for invalid position (zeertzjq).
closes: vim/vim#1417226dd09ad5e
Problem: can only call getregion() for current buffer
Solution: Allow to retrieve selections from different buffers
(Shougo Matsushita)
closes: vim/vim#1413184bf6e658d
Co-authored-by: Shougo Matsushita <Shougo.Matsu@gmail.com>
Problem: getregion() needs more tests
Solution: Run the getregion() test in both the legacy and Vim9 contexts
(Yegappan Lakshmanan)
closes: vim/vim#141144d55c54e30
Co-authored-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Problem: getregion() can be improved (after v9.1.120)
Solution: change getregion() implementation to use pos as lists and
one optional {opt} dictionary (Shougo Matsushita)
Note: The following is a breaking change!
Currently, the getregion() function (included as of patch v9.1.120) takes
3 arguments: the first 2 arguments are strings, describing a position,
arg3 is the type string.
However, that is slightly inflexible, there is no way to specify
additional arguments. So let's instead change the function signature to:
getregion(pos1, pos2 [, {Dict}]) where both pos1 and pos2 are lists.
This is slightly cleaner, and gives us the flexibility to specify
additional arguments as key/value pairs to the optional Dict arg.
Now it supports the "type" key to specify the selection type
(characterwise, blockwise or linewise) and now in addition one can also
define the selection type, independently of what the 'selection' option
actually is.
Technically, this is a breaking change, but since the getregion()
Vimscript function is still quite new, this should be fine.
closes: vim/vim#1409019b718828d
Co-authored-by: Shougo Matsushita <Shougo.Matsu@gmail.com>
Problem: Internal error when passing mark in another buffer to
getregion().
Solution: Don't allow marks in another buffer (zeertzjq)
closes: vim/vim#14076
Internal error when passing mark in another buffer to getregion()
421b597470
Problem: hard to get visual region using Vim script
Solution: Add getregion() Vim script function
(Shougo Matsushita, Jakub Łuczyński)
closes: vim/vim#13998closes: vim/vim#115793f905ab3c4
Cherry-pick changes from patch 9.1.0122, with :echom instead of :echow.
Co-authored-by: Shougo Matsushita <Shougo.Matsu@gmail.com>
Co-authored-by: Jakub Łuczyński <doubleloop@o2.pl>
Problem: upper-case of ß should be U+1E9E (CAPITAL LETTER SHARP S)
(fenuks)
Solution: Make gU, ~ and g~ convert the U+00DF LATIN SMALL LETTER SHARP S (ß)
to U+1E9E LATIN CAPITAL LETTER SHARP S (ẞ), update tests
(glepnir)
This is part of Unicode 5.1.0 from April 2008, so should be fairly safe
to use now and since 2017 is part of the German standard orthography,
according to Wikipedia:
https://en.wikipedia.org/wiki/Capital_%E1%BA%9E#cite_note-auto-12
There is however one exception: UnicodeData.txt for U+00DF
LATIN SMALL LETTER SHARP S does NOT define U+1E9E LATIN CAPITAL LETTER
SHARP S as its upper case version. Therefore, toupper() won't be able
to convert from lower sharp s to upper case sharp s (the other way
around however works, since U+00DF is considered the lower case
character of U+1E9E and therefore tolower() works correctly for the
upper case version).
fixes: vim/vim#5573closes: vim/vim#14018bd1232a1fa
Co-authored-by: glepnir <glephunter@gmail.com>
Problem: ml_get: invalid lnum when :s replaces visual selection
(@ropery)
Solution: substitute may decrement the number of lines in a buffer,
so validate, that the bottom lines of the visual selection
stays within the max buffer line
fixes: vim/vim#13890closes: vim/vim#138927c71db3a58
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: Wrong cursor position when dragging out of window.
Solution: Don't use ScreenCols[] when mouse is not in current window.
closes: vim/vim#13717ec14924368
Problem: r_CTRL-C works differently in visual mode
Solution: Make r_CTRL-C behave consistent in visual mode
in terminal and Windows GUI
in visual mode, r CTRL-C behaves strange in Unix like environments. It
seems to end visual mode, but still is waiting for few more chars,
however it never seems to replace it by any characters and eventually
just returns back into normal mode.
In contrast in Windows GUI mode, r_CTRL-C replaces in the selected area
all characters by a literal CTRL-C.
Not sure why it behaves like this. It seems in the Windows GUI, got_int
is not set and therefore behaves as if any other normal character has
been pressed.
So remove the special casing of what happens when got_int is set and
make it always behave like in Windows GUI mode. Add a test to verify it
always behaves like replacing in the selected area each selected
character by a literal CTRL-C.
closes: vim/vim#13091closes: vim/vim#13112476733f3d0
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: Visual highlight not working with cursor at end of screen line
and 'showbreak'.
Solution: Only update "vcol_prev" when drawing buffer text.
closes: vim/vim#128658fc6a1dae0
Problem: Using inclusive index for slice is not always desired.
Solution: Add the slice() method, which has an exclusive index. (closes
vim/vim#7408)
6601b62943
Cherry-pick a line in docs added later.
Co-authored-by: Bram Moolenaar <Bram@vim.org>
