ASan spotted a problem when using 'set background={light,dark}' with
color scheme solarized.
While loading the colors for color scheme 'g:colors_name', the pointer
on the value for this variable can become invalid, because of an 'unlet
colors_name' (part of an :highlight clear, syntax.c:6173).
To prevent the use of the freed value, decouple the value from
'g:colors_name' before calling load_colors() with it.
This removes the ability to start nvim via the following aliases in
favor of just using their command line arguments:
ex vim -e
exim vim -E
view vim -R
gvim vim -g
gex vim -eg
gview vim -Rg
rvim vim -Z
rview vim -RZ
rgvim vim -gZ
rgview vim -RgZ
This also removes Vi mode (-v) for consistency. From ':help -v':
-v Start Ex in Vi mode. Only makes a difference when the
executable is called "ex" or "gvim". For gvim the GUI is not
started if possible.
Compiler warns about buf always being nonnull.
buf is per function attribute always nonnull, so buf can be removed from
the assert(). But a buffer length of zero is also no problem, because it
makes uv_cwd() return a failure without writing into buf. So the
remaining length check can also be removed.
Explanation:
Running `:set encoding=utf-8` _after_ startup correctly initializes
multibyte; but mb_init() was _not_ called during startup if locale
detection (enc_locale()) failed. This wasn't a problem in Vim because
the Vim default encoding (latin1) does not require mb_init(). But Nvim
defaults to utf8, so mb_init() is required.
closes#1271closes#1672
Problem : Branch condition evaluates to a garbage value @ 2868.
Diagnostic : False positive.
Rationale : Array has_hotkey, declared at 2812, is initialized by
console_dialog_alloc (only the needed number of elements).
That same number of elements is used by
copy_hotkeys_and_msg.
Suggested path error is impossible, because it involves a
different number of elements in those functions.
Resolution : Above condition is cumbersome to prove through assertions.
Thus, we prefer to just initialize the array to all-false
at declaration point before calling console_dialog_alloc.
- process spawning was decoupled from the rest of the job control logic. The
goal is reusing it for spawning processes connected to pseudo terminal file
descriptors.
- job_start now receives a JobOptions structure containing all the startup
options.
Problem : Use after free @ 1795.
Diagnostic : Real issue.
Rationale : prev_curtab can in fact be freed as a result of call
`win_close_othertab(win, free_buf, prev_curtab);`, but it's
later used at
`sprintf(..., tabpage_index(prev_curtab));`.
This was introduced at
3ffc5d81c3.
Resolution : Move prev_idx calculation before the call freeing
prev_curtab.
Problems : Assigned value is garbage or undefined @ 5363.
Result of operation is garbage or undefined @ 5356.
Result of operation is garbage or undefined @ 5320.
Result of operation is garbage or undefined @ 5192.
Diagnostic : False positives / Multithreading issues.
Rationale : Suggested error paths contain incoherent values for
has_mbyte, enc_utf8, and enc_dbcs, which should always hold
the relationship has_mbyte = enc_utf8 || enc_dbcs, with
enc_utf8 and enc_dbcs being mutually exclusive.
Asserting on the globals, though, fails, because checker
believes they could be modified by other threads in
between.
Resolution : Make local copy of globals and assert relationship on them.
The current will segfault for large chunks of output because the output buffer
will be overrun.
Using unibi_format is simple because we can simply flush the buffer when its
full.
