Problem: Using a composing character as the end of a range inside a
collection may corrupt the NFA postfix stack
(Nathan Mills, after v9.1.0011)
Solution: When a character is used as the endpoint of a range, do not emit
its composing characters separately. Range handling only uses
the base codepoint.
supported by AI
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-9phh-423r-778r36d6e87542
Co-authored-by: Christian Brabandt <cb@256bit.org>
(cherry picked from commit e5667b9c15)
Problem: memline: a crafted swap files with bogus pe_page_count/pe_bnum
values could cause a multi-GB allocation via mf_get(), and
invalid pe_old_lnum/pe_line_count values could cause a SEGV
when passed to readfile() (ehdgks0627, un3xploitable)
Solution: Add bounds checks on pe_page_count and pe_bnum against
mf_blocknr_max before descending into the block tree, and
validate pe_old_lnum >= 1 and pe_line_count > 0 before calling
readfile().
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-r2gw-2x48-jj5p65c1a143c3
Co-authored-by: Christian Brabandt <cb@256bit.org>
(cherry picked from commit 7e8bdd348c)
Problem: matchadd() conceal may use unrelated syntax cchar.
Solution: Only use syntax cchar when syntax_flags has HL_CONCEAL
(zeertzjq).
closes: vim/vim#19459d01f234ec1
(cherry picked from commit 785ac9f228)
Problem: Page scrolling in Insert mode beeps (after 9.1.0211).
Solution: Fix incorrect return value of pagescroll(). Also invert the
return value of scroll_with_sms() to be less confusing and
match comments (zeertzjq).
fixes: vim/vim#19326closes: vim/vim#19327a8ce914db1
(cherry picked from commit bdd886622d)
Problem: :tab sbuffer may close old tabpage if BufLeave autocommand
splits window (after 9.1.0143).
Solution: Only close other windows if the buffer will be unloaded
(zeertzjq).
related: neovim/neovim#37749closes: vim/vim#193526da9f757c4
(cherry picked from commit e704529909)
Problem: Another case of buffer overflow with 'helpfile'.
Solution: Leave room for "tags" in the buffer (zeertzjq).
closes: vim/vim#1934021d591fb12
(cherry picked from commit 15061d322d)
Problem: tests: Test_language_cmd fails on OpenBSD because the test
uses an invalid locale name and expects the command to produce
an error. OpenBSD accepts (almost) any locale name as valid by
design, so the :lang command succeeds and the test fails.
Solution: Slightly update the "bad" locale name to make it something
that OpenBSD considers invalid by adding a dot (but not ending
with ".UTF-8"). Maintain the original two underscores in the
name because that ensures Windows will also see it as invalid
(Kevin Goodsell).
closes: vim/vim#19280371583642a
(cherry picked from commit 5e1a3df5ae)
Problem: Not enough tests for using plain_vgetc().
Solution: Add tests for using plain_vgetc() during various commands.
(zeertzjq)
closes: vim/vim#192362b6bdbc697
(cherry picked from commit e0b724de09)
Problem: Cmdline history not updated when mapping both <Up> and <CR>.
Solution: Consider the command typed when in Cmdline mode and there is
no pending input (zeertzjq).
Although the existing behavior technically does match documentation, the
"completely come from mappings" part is a bit ambiguous, because one may
argue that the command doesn't completely come from mappings as long as
the user has typed a key in Cmdline mode. I'm not entirely sure if this
change will cause problems, but it seems unlikely.
fixes: vim/vim#2771
related: neovim/neovim#36256closes: vim/vim#1860797b6e8b424
(cherry picked from commit 2407833ba1)
Problem: :wqall! doesn't quit when using :quit in BufWritePost
(after 8.0.1190).
Solution: Restore old value of "exiting" when calling not_exiting()
instead of always resetting it to FALSE (zeertzjq).
related: vim/vim#2205
closes: vim/vim#19212e803ad1c56
Problem: Crash when using :tabonly in BufUnload.
Solution: Set curbuf when setting curwin->w_buffer. Don't wipe out a
buffer if there are no other buffers. Don't decrement
b_nwindows if it was 0 before buf_freeall() (zeertzjq).
fixes: vim/vim#19088#issuecomment-3710172769
closes: vim/vim#19186fa64f92f6a
(cherry picked from commit eb5a7cc0dd)
This test is a copy of Test_bufunload_all() and requires too much
additional cleanup for the Windows log message.
(cherry picked from commit 8754118213)
Problem: memory leak when not evaluating (just parsing) invalid literal
dict.
Solution: Always clear the key's typval (Sean Dewar)
Though "check_typval_is_value(&tv) == FAIL && !evaluate" is maybe never
true, also always clear tvs if check_typval_is_value fails; at worst
this would be a no-op as their initial types are VAR_UNKNOWN.
closes: vim/vim#19178b10a3e1a20
check_typval_is_value change is for Vim9 script. (from 9.0.2163)
N/A patch:
vim-patch:9.0.2163: Vim9: type can be assigned to list/dict
Co-authored-by: Sean Dewar <6256228+seandewar@users.noreply.github.com>
(cherry picked from commit ba1d50fdc3)
Problem: :bdelete/bunload/bwipeout may attempt to switch to a closing
buffer, which fails. (after 9.1.2058)
Solution: don't consider switching to closing buffers (Sean Dewar)
closes: vim/vim#1910763d53de72d
Co-authored-by: Sean Dewar <6256228+seandewar@users.noreply.github.com>
(cherry picked from commit e002e4d7fc)
Problem: b_locked_split is not checked for :sbuffer, which allows
autocommands to leave windows open to freed buffers.
Solution: In do_buffer_ext, check just before possibly splitting, after
handling 'switchbuf'. Leave win_split to handle the check for
curbuf. (needed even if curbuf is not the target, as setting
the buffer after splitting may fail) (Sean Dewar)
closes: vim/vim#19096ac5c8ab6cc
Co-authored-by: Sean Dewar <6256228+seandewar@users.noreply.github.com>
(cherry picked from commit 5f871007d7)
Problem: Division by zero in :file after failing to wipe buffer
(after 8.2.4631).
Solution: Still call buf_clear_file() when failing to wipe buffer
(zeertzjq).
closes: vim/vim#190881aa5ca4ecb
(cherry picked from commit 97bfc0c99b)
Problem: No test that undofile format does not regress
Solution: include a sample undofile to make sure we are always able to
read it
This is so, that we don't unintentionally change the undofile format and
make sure we can load an undo file that has been created by an older
Vim.
closes: vim/vim#1612714382c8bc9
Convert the undo file in samples/ using method from #13973.
Co-authored-by: Christian Brabandt <cb@256bit.org>
(cherry picked from commit 94f7302e66)
Problem: Buffer overflow in buf_write() when converting incomplete
multi-byte characters (Kevin Goodsell)
Solution: Make the buffer slightly larger
closes: vim/vim#19007f99de42a9f
Co-authored-by: Christian Brabandt <cb@256bit.org>
(cherry picked from commit 444e1ffe3e)
Problem: Wrong cursor position after formatting with long 'formatprg'.
Solution: Don't show hit-enter prompt when there are stuffed characters.
Previously a stuffed character at the hit-enter prompt will dismiss the
prompt immediately and be put in the typeahead buffer, which leads to
incorrect behavior as the typeahead buffer is processed after the stuff
buffers. Using vungetc() when KeyStuffed is TRUE can fix this problem,
but since the hit-enter prompt isn't visible anyway (and is likely not
desired here), just skip the prompt instead, which also avoids a wait
when using "wait" instead of "hit-enter" in 'messagesopt'.
fixes: vim/vim#18905closes: vim/vim#1890650325c3d59
(cherry picked from commit 18642a63be)
Problem: In visual mode, g<End> does not move to the last non-blank
character when the end of a line is on the same line as the
cursor (after v9.0.1753)
Solution: Move the cursor back by one position if it lands after the
line (varsidry)
fixes: vim/vim#18657closes: vim/vim#18658adc85151f3
(cherry picked from commit b92b95e2c2)
Problem: Wrong restored cursor position when re-entering a buffer
previously viewed in a window after making changes to the same
buffer in another window.
Solution: Adjust per-window "last cursor" positions on buffer changes.
(zeertzjq)
closes: vim/vim#18655b2e6b328da
Problem: v:register is wrong in v_: command (after 9.1.1858).
Solution: Don't reset v:register for OP_COLON (zeertzjq)
related: https://github.com/vim/vim/pull/18583#issuecomment-3418030021closes: vim/vim#185970124320c97
While at it, also fix using stale set_prevcount value. That only matters
when readbuf1 ends with an operator or a register, which never happens,
but it's still good to avoid using a stale value.
(cherry picked from commit 68a54bfda6)
Problem: v:register not reset after Visual mode command.
(laktak)
Solution: Reset v:register if Visual mode was active before
do_pending_operator() (zeertzjq)
fixes: vim/vim#18579
related: vim/vim#5305closes: vim/vim#18583b3b47e540d
(cherry picked from commit aeeadddac4)
Problem: Window may have wrong height if resized from another tabpage.
Solution: Improve check for whether a tabline has been added (zeertzjq).
fixes: vim/vim#18518closes: vim/vim#18519bd3b958027
(cherry picked from commit 28355050a8)
Problem: 'cursorlineopt' "screenline" isn't redrawn when moving cursor
and then using line("w0") and :retab that does nothing.
Solution: Call redraw_for_cursorcolumn() when setting a valid w_virtcol
(zeertzjq).
closes: vim/vim#18506a084914361
(cherry picked from commit ba47cb7eda)
Problem: vertical separator of 'winfixwidth' windows may remain if they
become right-most windows from closing windows to the right.
Solution: Don't implicitly rely on frame_new_width to fix vseps, as the
call may be skipped for 'winfixwidth' windows to preserve
their width; do it explicitly in winframe_remove (Sean Dewar).
Note that I prefer win_new_width here over setting w_width directly, which
would've previously been done by win_split_ins after frame_add_vsep, as this
wasn't true for winframe_remove.
Though the equivalent issue of bottom 'winfixheight' windows leaving stray
statuslines with &ls=0 doesn't seem to exist, test it anyway.
closes: vim/vim#18481620c655677
Nvim: calling win_new_width over setting w_width directly is especially
important in making sure stuff like w_view_width is correct here.
Co-authored-by: Sean Dewar <6256228+seandewar@users.noreply.github.com>
(cherry picked from commit 7923e847ca)
Problem: tests: "Untitled" file not removed when running Test_crash1_3 alone
with TEST_FILTER (after v9.1.0695)
Solution: Use a TearDown function instead of another test.
(zeertzjq)
closes: vim/vim#15578closes: vim/vim#15577d56c451e1c
(cherry picked from commit 532cc88604)
Problem: tests: test_crash leaves Untitled file around
Solution: cleanup at the end of the test_crash.vim test file
cd83173def
Co-authored-by: Christian Brabandt <cb@256bit.org>
(cherry picked from commit 71662bbb49)
Problem: buffer-overflow in do_search() with 'rightleft'
(SuyueGuo)
Solution: after reversing the text (which allocates a new buffer),
re-calculate the text length
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-v2x2-cjcg-f9jmcacb6693c1
Add missing change from patch 8.1.1270.
Omit `call delete('Untitled')`: moved again in patch 9.1.0695.
Co-authored-by: Christian Brabandt <cb@256bit.org>
(cherry picked from commit 69a9a25fcc)
Problem: Option insecure flags not copied when splitting window.
Solution: Move window-local insecure flags to winopt_T and copy them
properly (zeertzjq).
closes: vim/vim#18434b3740f4b00
(cherry picked from commit 42f1864b62)
Problem: :set doesn't clear local insecure flag like :setlocal does.
Solution: Also clear the local insecure flag when using :set (zeertzjq).
This applies to local options like 'wrap', 'foldtext' and 'foldexpr',
whose global flags are actually never used. For global-local options
like 'statusline' the behavior is already correct, so add some tests.
related: vim/vim#18434fec5586a45
(cherry picked from commit ff564237d2)
Problem: 'nowrap' in a modeline may hide malicious code.
Solution: Forcibly use '>' as 'listchars' "extends" if 'nowrap' was set
from a modeline (zeertzjq).
Manual `:setlocal nowrap` disables this behavior. There is a separate
problem with `:set nowrap` that also applies to some other options.
related: vim/vim#18214
related: vim/vim#18399closes: vim/vim#184259d5208a931
Cherry-pick some test_modeline.vim changes from patches 9.0.{0363,0626}.
(cherry picked from commit 0fa0717d4e)
Problem: Crash in BufLeave/WinLeave/TabLeave when closing window after
BufUnload closes all other windows in the tab page.
Solution: Avoid duplicate BufLeave/WinLeave events. Trigger TabLeave
before removing the buffer (zeertzjq).
related: vim/vim#14166
related: neovim/neovim#33603closes: vim/vim#183300c70820015
(cherry picked from commit c9f6267402)
Problem: Using common name in tests leads to flaky tests.
Solution: Rename files and directories to be more specific.
3b0d70f4ff
This includes only test_help.vim changes.
Co-authored-by: Bram Moolenaar <Bram@vim.org>
(cherry picked from commit 50efe61c3c)
Problem: a pattern that involves a backref on a different line does not
match when 'ignorecase' is set (QiWei, after v9.1.0645)
Solution: Use MB_STRNICMP when ignorecase is set, fix tests to close
swapfiles
related: vim/vim#14756fixes: vim/vim#17470closes: vim/vim#18104bf82e58a70
Co-authored-by: Christian Brabandt <cb@256bit.org>
(cherry picked from commit 24020ef2dd)
Problem: Another outdated comment in eval.c (after 9.1.1665).
Solution: Remove that comment as well. Add a few more tests for mapnew()
that fail without patch 8.2.1672 (zeertzjq).
closes: vim/vim#180896b56711804
(cherry picked from commit 639f9f4cda)
Problem: tests: test_search leaves a few swapfiles behind
Solution: Use :bw! instead of :close to close the swapfile at the end of
the test.
related: vim/vim#17933a2bb21a895
Co-authored-by: Christian Brabandt <cb@256bit.org>
(cherry picked from commit 9e8d551b1e)
Problem: Ctrl-G/Ctrl-T does not ignore the end search delimiter
(irisjae)
Solution: Check if the pattern ends with a search delimiter and ignore
it, unless it is part of the pattern.
fixes: vim/vim#17895closes: vim/vim#17933c03990d30f
Co-authored-by: Christian Brabandt <cb@256bit.org>
(cherry picked from commit 1eca030fb2)
