Problem: Deeply nested regexp groups can cause uncontrolled recursion
in the regexp compiler and exhaust the C stack.
Solution: Limit recursive regexp parsing depth in both the backtracking
and NFA compilers (lipengyu)
closes: vim/vim#20731a79cd6bfc3
Co-authored-by: lipengyu <lipengyu@kylinos.cn>
Problem: :argdelete with pattern leads to wrong argidx().
Solution: Correct argidx() in both branches of ex_argdelete(). Also use
ARGCOUNT macro in two more places (zeertzjq).
related: patch 7.4.1119
related: neovim/neovim#40564
closes: vim/vim#206973b40a14a46
Problem: ml_get error when changing hidden buffer in Python.
Solution: Block updating folds. (closesvim/vim#7598)
----
"ctx_switch()", "ctx_restore()" obsolete "switch_buffer()" and
"restore_buffer()".
Latter are unused since https://github.com/neovim/neovim/pull/15831.
Mark them as N/A (until some test fails).
----
3e0107ea16
Co-authored-by: Bram Moolenaar <Bram@vim.org>
Problem: Visual block reselection wrong with 'virtualedit' when line
lengths are different (Alex Yang, after 8.2.3494).
Solution: Set the entire cursor position to old position when computing
target curswant, since the check_cursor() added in 8.2.3494
may change cursor column as well (zeertzjq).
fixes: vim/vim#20746closes: vim/vim#207488cddbfe468
Problem: extend() and extendnew() don't handle NULL expr2 properly
(Mao-Yining)
Solution: Still set the return value when expr2 is NULL (zeertzjq).
fixes: vim/vim#20758closes: vim/vim#20759e397c82a04
Problem: filetype: hip files are not recognized
Solution: Detect *.hip files as hip filetype, include filetype, syntax
and indent plugins, update makemenu.vim and synmenu.vim (Young)
Round out HIP (Heterogeneous-compute Interface for Portability) support
to mirror the existing CUDA files:
- autoload/dist/ft.vim: detect the ".hip" extension as filetype "hip"
- ftplugin/hip.vim: behave like C++ by sourcing ftplugin/cpp.vim
- indent/hip.vim: use cindent, like indent/cuda.vim
- makemenu.vim / synmenu.vim: add a Syntax menu entry
The syntax/hip.vim file already sources syntax/cpp.vim and adds the
HIP-specific keywords, matching syntax/cuda.vim.
closes: vim/vim#20773b3ad239038
Co-authored-by: Young <young20050727@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Problem: Test_spelldump_prefixtree_overflow() resets 'runtimepath' to
defaults, which can expose personal spell files to later tests
(Jun-ichi Takimoto, after v9.2.0662)
Solution: Save and restore the test runner's 'runtimepath' value (coyaSONG).
fixes: vim/vim#20765closes: vim/vim#20766f16e30e19d
Co-authored-by: coyaSONG <66289470+coyaSONG@users.noreply.github.com>
Co-authored-by: OpenAI Codex <noreply@openai.com>
Problem:
Continue separators normalization, and try to keep it at the
nvim <-> external boundary, e.g., `fn.xxx`, `api.xxx`, `:xxx`
Solution:
some key changes
- normalize `$HOME-windows`
- normalize entry points of changing directory
- `nvim_set_current_dir()`, `chdir()`
- normalize the named pipe
- `--listen` arg, `--server` arg, `:restart`
- `serverstart()`, `sockconnect()`, `serverstop()`
- make `expand()` respect 'shellslash' again
- clean up `did_set_shellslash`
- replace `forward_slash` with `TO_SLASH`
- remove obsolete `TMP_PATHSEPSTR`
- remove `slash_adjust` in `do_autocmd_dirchanged`?
- make `fnamemodify()` always return `/` (except when substituting
separators via `:s`, `:gs` ?)
Note:
- these funcs still apply `slash_adjust` on return, as before:
`:pwd`, `chdir()`, `exepath()`, `getcwd()`
- these funcs alwarys return `/`, unlike before the normalization PRs
- `getcompletion()`, `finddir()`, `findfile()`
Also
- clean up code, comments, formatting and tests
- move `TO_SLASH` from `f_chdir` to `changedir_func`
- move `TO_SLASH` from `f_bufadd` to `buflist_new`
Co-authored-by: Justin M. Keyes <justinkz@gmail.com>
Problem:
Test_set_cursor is flaky in CI. MsgPack::Raw Perl module
has a heap-overflow issue.
See https://github.com/jacquesg/p5-MsgPack-Raw/issues/4
Solution:
Skip the test until the upstream module is fixed.
fix(iconv): conversion to utf-16be using iconv is inconsistent
vim-patch:9.2.0769
Problem: enc_canonize function changes utf-16be to utf-16 but in linux
type utf-16 defaults to utf-16le.
Solution: Creating a separate entry for utf-16be in enc_canon_table.
Note: the effect is only visible on iconv implementations that
treat "utf-16" and "utf-16be" differently, so the test does
not necessarily fail on an unpatched Vim. But the bug is
visible in vim.iconv. (Manoj Panda)
from: vim/vim@2a63f74
closes: neovim#40262
Signed-off-by: Manoj Panda <manojpandawork@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: Some test_mksession tests do not cleanup all the state
Solution: Add commands to clean up state introduced by the test
(Illia Bobyr)
Before this change the following 4 tests were failing when executed
individually:
Test_mksession_arglocal_localdir
Test_mksession_buffer_count
Test_mksession_one_buffer_two_windows
Test_mksession_winminheight
As in
```
TEST_FILTER=winminheight make test_mksession
```
Yet, when ran as part of the whole test suite they succeeded.
This was due to some state leaking from one test into another.
I think this is bad, as it can confuse someone making changes in the
relevant area.
`Test_mksession_winminheight` is actually still broken a bit, and
requires `winheight` and `winwidth` set at the beginning of the test,
rather than later, when it actually matters. This exposes a subtle bug
in the session restore script. I have a patch in a separate commit.
closes: vim/vim#20691834b8d218f
Co-authored-by: Illia Bobyr <illia.bobyr@gmail.com>
Problem: tests: Test_fuzzy_completion_bufname_fullpath() creates an
unnecessary directory with the name of a file.
Solution: Only create the parent directory of the file (zeertzjq).
closes: vim/vim#2069598efa50279
Problem: tests: still some flaky screendump tests
(James McCoy)
Solution: Replace flaky VerifyScreenDump checks with assert_* assertions
for Test_visual_block_scroll and Test_scrolloffpad_with_folds,
and remove the now-unused dump files, mark those tests as
flaky (which happened previously for screendump tests
automatically) (Yasuhiro Matsumoto).
fixes: vim/vim#20096
related: vim/vim#20095cf5d7102b9
Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Problem: tests: still a few flaky tests
Solution: Add WaitForAssert to test_messages.vim, use a smaller terminal
window for test_tabpanel, add TermWait() in test_messages
to handle DECQRM messages.
closes: vim/vim#200740bc64b19a2
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: tests: Some tests are flaky and cause CI to fail
Solution: Add WaitForAsserts() calls to reduce flakiness
closes: vim/vim#200501940bcb243
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: Some code for 'autocompletedelay' is no longer needed now that
'autocompletedelay' doesn't block redraw (after 9.2.0739).
Solution: Remove unnecessary code. Also remove a duplicate screendump
and an outdated comment in test (zeertzjq)
closes: vim/vim#206860b86b97cc9
Problem: If 'autocompletedelay' is non-zero, 'autocomplete' doesn't
work when recording a register (after 9.2.0750).
Solution: Still produce K_COMPLETE_DELAY when recording a register, and
drop it in gotchars_add_byte() instead (zeertzjq).
This patch only changes the behavior when recording a register.
Replaying a register with 'autocomplete' still doesn't fully work
regardless of 'autocompletedelay', as 'autocomplete' isn't triggered
when there is pending input.
closes: vim/vim#20675a658728918
Problem: After 'autocompletedelay' was made non-blocking, the deferred
popup can misbehave: a pending autocomplete survives leaving
Insert mode and then keeps waking the editor in Normal mode,
the deferral is recorded into registers while recording a
macro, the popup appears an extra 'updatetime' late when
'autocompletedelay' is larger and a CursorHoldI autocommand
exists, CursorHoldI can fire twice without an intervening
keypress, and an open balloon is dismissed (after v9.2.0739)
Solution: Treat the deferral like CursorHold: only keep it pending in
Insert mode and not while recording, with pending typeahead,
or when completion is already active; drop it when Insert mode
ends; measure the delay from when the user typed so a
CursorHold in between does not push the popup back; and do not
let the deferral re-enable CursorHoldI or dismiss the balloon.
(Hirohito Higashi).
closes: vim/vim#206691f0f14bc2f
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem: 'autocompletedelay' interferes with i_CTRL-K (after 9.2.0739).
Solution: Clear the pending autocompltion from the previous key when a
new key is typed.
closes: vim/vim#206660d292e2067
Problem: 'autocompletedelay' interferes with CTRL-G U (after 9.2.0739).
Solution: Restore the flag for CTRL-G U.
related: vim/vim#8937
related: vim/vim#206669fb5b5d876
Problem: With a non-zero 'autocompletedelay', Insert-mode autocommands
(TextChangedI, TextChangedP, CursorMovedI) are delayed, and
while typing faster than the delay they are dropped entirely,
because the delay blocks the main loop.
Solution: Make 'autocompletedelay' non-blocking: instead of busy-waiting
before showing the popup menu, defer it with an input-wait
timeout (K_COMPLETE_DELAY) modeled on CursorHoldI, so typing
stays responsive and the Insert-mode autocommands fire normally.
The delay timer coexists with 'updatetime': the main loop waits for the
sooner of the two and triggers the event whose deadline was reached, so
'autocompletedelay' no longer shadows CursorHold timing. Changing the
completion leader, for example with Backspace, updates the visible popup
immediately like a zero delay; only the first popup is deferred.
Update the 'autocompletedelay' screendumps for the non-blocking display.
One test opened the menu with CTRL-N right after the delay expired and
could race with the deferred popup, so it now waits a little longer than
the delay before sending the key.
fixes: vim/vim#20591closes: vim/vim#205988ce43ea4e3
Also include some insexpand.c and ui.c changes from patch 9.2.0750.
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem: Session with multiple tabpages sets 'winminheight' to 0.
Solution: Only save 'winminheight' and 'winminwidth' once (zeertzjq).
related: vim/vim#8119
related: neovim/neovim#40493closes: vim/vim#20673294dec827d
Problem: Crash when reading truncated spellfile (MarkLee131)
Solution: Set sl_sofo to TRUE in set_sofo() once sl_sal has been
converted to the soundfold layout.
Supported by AI.
closes: vim/vim#20660488a3eed12
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: filetype: SSH keys and related filetypes not recognized
Solution: Detect sshpublickey, sshknownhosts sshauthorizedkeys and
sshallowedsigners filetypes, add syntax scripts for those
filetypes (Fionn Fitzmaurice)
This adds syntax highlighting for SSH public keys, as well as related
filetypes derived from this (SSH authorized keys, SSH known hosts and
SSH allowed signers).
Also add filetype detection based on the path and name.
closes: vim/vim#206356e66ebc0fd
Co-authored-by: Fionn Fitzmaurice <git@fionn.computer>
Problem: Mapped typed keys didn't interrupt completion in
complete_check() (Yikai Zhao)
Solution: Also interrupt when in_compl_func and not replaying a register.
(glepnir)
closes: vim/vim#5547closes: vim/vim#2064337d85f5f1a
Problem: A crafted swap file can cause an out-of-bounds write during
recovery when the same block is referenced twice with
different pe_page_count values (cipher-creator)
Solution: Check hp->bh_page_count against page_count after mf_get() and
clamp page_count to the actual block size.
closes: vim/vim#2064543939cf9eb
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: With PHP omni-completion, a crafted file can potentially
execute arbitrary commands when completing a class member.
Solution: Quote the class name before inserting it into the search()
pattern run via win_execute().
43afc581a3
Tests only. The bug is not ported yet.
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem: [security]: With C omni-completion, a crafted tags file can execute
arbitrary Ex commands when completing a struct/union member
(cipher-creator)
Solution: Escape the type field before inserting it into the :vimgrep
pattern so it cannot close the pattern and start a new command
(Hirohito Higashi).
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x6b611b0d15
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Problem: The "%" command and bracket/text-object motions can skip the
matching paren or bracket on a line with quotes and a trailing
backslash.
Solution: Use the quote state at the search start when an odd-quote line
is continued with a backslash, instead of always treating the
search as starting in quotes (Barrett Ruth).
closes: vim/vim#20631c44a6561cc
Co-authored-by: Barrett Ruth <br@barrettruth.com>
Problem: ":filetype detect" is a valid command but not offered by
command-line completion.
Solution: Add "detect" to the completion candidates (glepnir)
closes: vim/vim#20625984f29860e
Co-authored-by: glepnir <glephunter@gmail.com>
Problem: filetype: supertux info pattern is relative to current
directory (after 9.2.0716).
Solution: Add `*/` to the start of the pattern (zeertzjq)
closes: vim/vim#20629c30ee2efa9
Problem:
cmdwin (the `:q` cmdline buffer) has various limitations which require
special-casing all over the codebase.
Besides complicating the code, it also breaks async plugins if they try
to create buffers/windows after some work is done, if the user happens
to open cmdwin at the wrong the moment:
Lua callback: …/guh.nvim/lua/guh/util.lua:531:
E11: Invalid in command-line window; <CR> executes, CTRL-C quits
stack traceback:
[C]: in function 'nvim_buf_delete'
…/guh.nvim/lua/guh/util.lua:531: in function <…/guh.nvim/lua/guh/util.lua:526>
Solution:
Just say no to "inception". Reimplement cmdwin as a normal buffer+window.
All of the cmdwin contortions (in both core, and innocent plugins) exist
literally only to support "inception": recursive
cmdwin-in-cmdline-things, like `<c-r>=`, `/`, search-during-substitute,
`:input()`, etc. So we just won't support that (though I have
a potential plan for that later, which I call "modal parking lot").
The benefit is that plugins, and core, no longer have to care about
cmdwin.
BONUS:
- mouse-drag on vertical separators works (it only worked for
horizontal/statusline before)
- inccommand-in-cmdwin now works correctly, for free (thus don't need
#40077).
POTENTIAL FOLLOWUPS
- Drop `CHECK_CMDWIN` ("E11: Invalid in command-line window"), allow chaos.
- Unify `BUFLOCK_OK` / `LOCK_OK` ?
DESIGN:
- Eliminate lots of C globals, `EX_CMDWIN`, etc.
- `text_locked()` no longer reports true for cmdwin.
- cmdwin = a normal window with 'winfixbuf', 'bufhidden=wipe',
'buftype=nofile'. Invariants come from those options rather than
special cases throughout the codebase.
- `nv_record` for q:/q//q? calls Lua
`nlua_call_vimfn("vim._core.cmdwin", …)`. No `K_CMDWIN`
/ cmdline-reader detour.
- `cedit_key` (`c_CTRL-F`) schedules a deferred event that calls
`vim._core.cmdwin.open(type, content, pos)` and returns `Ctrl_C` so
the in-flight cmdline cancels. Reader state is not serialized; instead
the captured `(type, line, col)` is replayed via
`nvim_feedkeys(type..line.."<CR>", "nt", …)` after user confirms.
- On confirm/cancel: `<CR>` / `<C-C>` calls into Lua which closes the
window and re-feeds the cmdline.
BREAKING CHANGES:
- Expression-register cmdline (`<C-R>=` from insert-mode) no longer
supports cmdwin. Same applies to `input()` / `inputlist()` (already
covered by `text_locked`).
- Usage of cmdwin in macros/mappings will probably break (assuming they
ever worked).
Problem: [security]: A crafted spell file with non-collapsing SAL rules
can make soundfold() write one byte past the end of the
MAXWLEN result buffer. This is the same class of
out-of-bounds write as GHSA-q8mh-6qm3-25g4 (fixed in 9.2.0698
for the SOFO branch), found while auditing the surrounding
code.
Solution: Bound the single-byte SAL result writes and the terminating
NUL to MAXWLEN - 1, matching the SOFO branch.
The single-byte branch of spell_soundfold_sal() guarded its writes with
"reslen < MAXWLEN", allowing reslen to reach MAXWLEN (254). The trailing
"res[reslen] = NUL" then wrote at index 254 of the 254-byte stack buffer
res[MAXWLEN], an off-by-one out-of-bounds write. Input is case-folded to
about 253 characters, so a 253-character argument together with a SAL map
that does not collapse (collapse_result false) reaches the boundary.
Related to previous issue
[GHSA-q8mh-6qm3-25g4](https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4)
(9.2.0698)
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2d22ff1c955
This is N/A as Nvim doesn't have spell_soundfold_sal() which is only
used in the !has_mbyte code path.
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem: tests: strange indent in Test_autocmd_dup_arg()
(after v9.2.0708)
Solution: Indent using the settings in the modeline.
closes: vim/vim#2061905df981c35
Problem: :syn sync without an argument also lists every defined cluster
Solution: Fix control flow in syn_cmd_list() so that only the syncing
items are printed when this function gets called by :syn sync.
(dmitmel)
closes: vim/vim#20614f2954c821e
Problem: Leak in do_autocmd in error case (Cheng)
Solution: goto err_exit in the error case and clean up, make the double
++once an actual error
closes: vim/vim#2060698f5171ef6
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: When the cursor line has concealed text before the start of the
completion, the insert-mode completion popup is drawn at the wrong
screen column and the cursor no longer lines up with the completed
text.
Solution: Record the concealed width before the cursor on its screen line in
a new `win_T` field while `win_line()` draws it, subtract it in
`pum_display()` to place the menu over the visible text, and redraw
the cursor line so `win_line()` corrects the cursor too.
closes: vim/vim#20539d167c50de4
Co-authored-by: Barrett Ruth <br@barrettruth.com>
Problem: With 'winfixbuf' set in the current window, :windo and :tabdo
create an extra split window, even though they only visit
existing windows/tabpages and don't change the current
window's buffer (Collin Kennedy)
Solution: Skip the 'winfixbuf' escape in ex_listdo() for :windo and
:tabdo (ShivaPriyanShanmuga)
fixes: vim/vim#14301closes: vim/vim#206005767d80b37
Problem: ':delete #' silently fails to update "# and clobbers "0.
Solution: Treat "# like "/, writable only with :let and setreg().
closes: vim/vim#205927aeab74687
Co-authored-by: Doug Kearns <dougkearns@gmail.com>
