Problem: [security]: Out-of-bounds write with soundfold()
(cipher-creator)
Solution: Add an abort condition to the for loop to validate the buffer
size.
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4
Supported by AI
497f931f85
This is N/A as it only changes the !has_mbyte code path.
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: The "%" command can be very slow on a long line that contains
many slashes, for example a line of base64 data.
Solution: When looking for a line comment, scan the line only once while
skipping over strings, instead of rescanning from the start for
every slash. Move check_linecomment() to cindent.c so it can
reuse the file-local skip_string().
related: vim/vim#20491
fixes: vim/vim#20557
closes: vim/vim#205759f9af034ad
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem: ':registers #' does not display the value of the '#' register.
Solution: Filter the '#' :registers output on a '#' arg instead of '%'
(Doug Kearns).
closes: vim/vim#205890cafe56b74
Co-authored-by: Doug Kearns <dougkearns@gmail.com>
Problem: ":filetype plugin<Tab>" gives "pluginindent" because a
sub option before the cursor is treated as already given.
Solution: only skip plugin and indent when followed by white space.
(glepnir)
closes: vim/vim#20594fe65f23aca
Co-authored-by: glepnir <glephunter@gmail.com>
Problem: Wrong dot-repeat when calling complete() while filtering
Ctrl-N completion.
Solution: Also check compl_started for whether completion is active.
(zeertzjq)
related: neovim/neovim#40346
closes: vim/vim#2059537a7e4944f
Problem: Error when using "none" for GUI color is confusing.
Solution: Mention that the name should perhaps be "NONE". (closesvim/vim#1400)
5b9f57262f
Co-authored-by: Bram Moolenaar <Bram@vim.org>
Problem: tests: Test_cd_from_non_existing_dir() fails on Solaris
Solution: Skip the test on Solaris (Vladimír Marek).
Test_cd_from_non_existing_dir() depends on deleting the current working
directory. Solaris does not allow that, so skip the test there.
closes: vim/vim#20563b464c36bf9
Co-authored-by: Vladimír Marek <vlmarek13@gmail.com>
Problem: tests: Test_recover_corrupted_swap_file() cannot handle
symlinks
Solution: Use writefile(readblob()) instead (Vladimír Marek)
Test_recover_corrupted_swap_file1() copies prebuilt corrupt swap samples
before recovering them. In an out-of-source-tree build those sample
files may be symlinks into the source tree. filecopy() preserves
symlinks, so the copied target may remain a symlink. Recovery opens
swap files with O_NOFOLLOW, so that copied symlink cannot be opened.
Read the sample as a blob and write it back so the recovery target is a
real swap file.
closes: vim/vim#2056188cbd00312
Co-authored-by: Vladimír Marek <vlmarek13@gmail.com>
Problem: On MS-Windows it is not possible to switch to a buffer by name
with ":b" (including via command-line completion) when the
buffer name contains '%'.
Solution: Do not escape '%' and '#' for the ":buffer" command on
MS-Windows. Since ":buffer" has no EX_XFILE these are not
expanded, and escaping them as "\%"/"\#" makes buffer name
matching fail when '%'/'#' is in 'isfname' (the backslash is
treated as a path separator).
fixes: vim/vim#20529closes: vim/vim#205481a96e07bf6
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem: Crash with TextPut autocmd when pasting in normal mode in a
terminal buffer.
Solution: Skip the TextPut autocmds when reg and insert are both NULL
and regname is not '.' (Foxe Chen).
closes: vim/vim#204072e7833bde9
Co-authored-by: Foxe Chen <chen.foxe@gmail.com>
Problem: [security]: s:NetrwLocalRmFile() escapes only the backslash in
the file name before passing it to :execute, so a name
containing "|" injects arbitrary Ex commands when the file is
deleted (cipher-creator)
Solution: Use fnameescape() to correctly escape the file name
(Yasuhiro Matsumoto).
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-vhh8-v6wx-hjjh
Supported by AI
55bc757a5d
Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Problem: [security]: a crafted spell file with a self-referential
BY_INDEX node in the prefix tree can drive dump_prefixes()
past the end of its MAXWLEN-sized depth arrays on :spelldump
(cipher-creator)
Solution: only descend while depth < MAXWLEN - 1, as the sibling trie
walkers already do (Yasuhiro Matsumoto)
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-qm9w-fmpj-879h
Supported by AI
8325b193bb
Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Problem: With 'longest', 'smartcase' is ignored when filtering matches:
"inp" offers only "InputEvent", and an uppercase pattern gives
different results for CTRL-N and CTRL-P.
Solution: 'longest' rewrites the leader with the common prefix, picking
up uppercase the user never typed. Judge case from the typed
text instead, and match the auto-inserted part of the leader
case-insensitively so CTRL-N and CTRL-P give the same result.
(glepnir)
related: neovim/neovim#40259
closes: vim/vim#2053350fe45aca7
Co-authored-by: glepnir <glephunter@gmail.com>
Problem: [security]: a crafted spell file can drive tree_count_words()
past the end of its MAXWLEN-sized depth arrays; the descent
loop has no depth bound.
Solution: only descend while depth < MAXWLEN - 1, as the sibling trie
walkers already do; apply the same guard to sug_filltree().
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq
Supported by AI.
a80874d9b8
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: filetype: tf files sometimes incorrectly recognized
(Christian Robinson)
Solution: Add support for g;filetype_tf variable to override detection,
re-write the filetype detection loop
closes: vim/vim#20510
Supported by AI
522a39a489
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: When a candidate gets truncated to MATCH_MAX_LEN and ends up
the same length as the needle, the n == m shortcut would
return SCORE_MAX with positions 0..n-1, even if the strings
actually differ.
Solution: Only use the shortcut if the truncated strings are truly equal.
Otherwise, fall back to regular matching.
Example:
echo matchfuzzypos(['x' .. repeat('a',1024)], repeat('a',1024))
closes: vim/vim#204751437f47815
Co-authored-by: glepnir <glephunter@gmail.com>
Problem: Problem with initializing the length of range() lists
Solution: Set length explicitly when it shouldn't contain any items
range() may cause a wrong calculation of list length, which may later
then cause a segfault in list_find(). This is usually not a problem,
because range_list_materialize() calculates the length, when it
materializes the list.
In addition, in list_find() when the length of the range was wrongly
initialized, it may seem to be valid, so the check for list index
out-of-bounds will not be true, because it is called before the list is
actually materialized. And so we may eventually try to access a null
pointer, causing a segfault.
So this patch does 3 things:
- In f_range(), when we know that the list should be empty, explicitly
set the list->lv_len value to zero. This should happen, when
start is larger than end (in case the stride is positive) or
end is larger than start when the stride is negative.
This should fix the underlying issue properly. However,
- as a safety measure, let's check that the requested index is not
out of range one more time, after the list has been materialized
and return NULL in case it suddenly is.
- add a few more tests to verify the behaviour.
fixes: vim/vim#13557closes: vim/vim#13563
--------
Vim9 (non) materialize list is N/A.
Port only tests.
df63da98d8
Co-authored-by: Christian Brabandt <cb@256bit.org>
Co-authored-by: Tim Pope <tpope@github.com>
Problem: statusline: buffer overflow with item groups
Solution: Fix the issues (see below) (Sébastien Hoffmann)
Fix various buffer overflow bugs (examples assume MAXPATHL==4096):
- truncated item groups where minwid>maxwid:
vim --clean +"set ls=2 stl=%<%{%repeat('x',4096-11)%}%50.5(12🙂345%)"
leads to fillchars spilling over the end of the group/buffer while trying to
compensate for truncating at a multicell character because minwid<=maxwid is assumed
- left-aligned item groups with multi-byte fillchar:
vim --clean +"set ls=2 fillchars+=stl:∙ stl=%<%{%repeat('x',4096-3)%}%-2(X%)"
wrongly leads to padding at the end of the statusline and `p-out==4097`
because the bounds check assumes a 1-byte fillchar
- right-aligned item groups with 1-byte fillchar:
vim --clean +"set ls=2 stl=%<%{%repeat('x',4096-4)%}%4(XY%)"
leads to "YX" instead of "XY" at the end of the statusline
because `memmove` is done before adjusting the offset
- right-aligned item groups with multi-byte fillchar:
vim --clean +"set ls=2 fillchars+=stl:∙ stl=%5(X%)"
leads to "∙∙∙∙<e2>", i.e. the fillchar is being written over the group contents
and eventually being overwritten itself at the second byte with the final NUL,
because the padding counter assumes a 1-byte fillchar; to crash vim,
vim --clean +"set ls=2 fillchars+=stl:∙ stl=%<%{%repeat('x',4096-149)%}%50(X%)"
related: neovim/neovim#40219
closes: vim/vim#20522d249884340
Co-authored-by: Sébastien Hoffmann <contact@shoffmann.dev>
Problem: Composing chars are no longer accepted in end-id abbreviation
(after 9.2.0629).
Solution: Unescape all chars using vim_unescape_csi() instead of using
mb_unescape() on individual chars, so that mb_ptr2len() and
MB_PTR_ADV() can still be used.
closes: vim/vim#2051423a84d28a8
Problem: 0x80 and 0x9b byte not unescaped when checking for valid abbr
(Mao-Yining)
Solution: Use mb_unescape() (zeertzjq).
fixes: vim/vim#20506closes: vim/vim#205081958c991a8
Problem: Keys valid in CTRL-X mode are never mapped while insert
completion is active, so <C-N> and <C-P> cannot be remapped
for completion started by complete().
Solution: Do not disable mappings in CTRL_X_EVAL mode. In this mode a
mapping cannot interfere with selecting the completion
method, which is what the no-mapping rule exists for.
related: vim/vim#6440
related: vim/vim#16880
closes: vim/vim#20489076585e6ad
Co-authored-by: Thomas M Kehrenberg <tmke8@posteo.net>
Problem: Deciding whether a group is in a "contains"/cluster list scans
the list and expands clusters on every check, which is slow for
syntaxes with large lists (e.g. plugins such as netrw).
Solution: Resolve each list once into a sorted, cluster-expanded set of
group IDs and use a binary search; cache it per syntax block and
drop the cache when syntax definitions change (Hirohito Higashi).
closes: vim/vim#2049048fbae4378
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Problem: The "%" command jumps to parens and braces inside comments,
unlike the "=" operator (cindent), which ignores them.
Solution: When 'comments' defines C-style comments and "%" is not in
'cpoptions', skip matching parens inside such comments, except
when the cursor is inside a comment so a match there can still
be found.
fixes: vim/vim#20329
related: vim/vim#20111
closes: vim/vim#20491b8a109dcfb
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem: gq (and other filters) on an empty buffer fail with
"E20: Mark not set": when the filter produces no output,
do_filter() still subtracts the line count from '[ and '],
pushing '] to line 0.
Solution: when the filter produces no output, put '[ and '] on a valid
line instead of subtracting past line 1 (glepnir).
related: neovim/neovim#30593
closes: vim/vim#19061aefbca2977
Problem: 'autoindent' not stripped with virtualedit=onemore (after
9.2.0510).
Solution: Restore the decrement of cursor column when it's on NUL.
fixes: neovim/neovim#40183closes: vim/vim#204764b13277edd
Problem: tests: test_codestyle does not notice lines containing only a
tab
Solution: Fix the whitespace issue in eval.txt, update test_codestyle to
notice such issues (Hirohito Higashi)
closes: vim/vim#185955b5290ec02
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Problem: tests: test_cmdline.vim leaves swapfiles behind
Solution: Close open buffers using :bw! instead of :close!
bf1b41e387
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: tests: test_sort.vim leaves swapfiles behind
Solution: Close open buffers using :bw! instead of :close!
f8c550fea0
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: tests: test_registers fails when not run under X11
Solution: filter out warning message
b2a8df35e8
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: unmarking a regular file when there are directories in the markings
list also removes the 2match highlight from those directories.
Solution: correctly rebuild the match pattern from the remaining markings,
using the right regex trailer for each entry in the list.
closes: vim/vim#20461affd4b5964
Co-authored-by: J. Paulo Seibt <jpseibt@gmail.com>
Problem:
* 'shellcmdflag' states that its default value is set according to the
value of 'shell', but this behavior is not yet implemented on Windows.
The same applies to 'shellpipe', 'shellredir', and 'shellxquote'.
* On Windows, Git is often installed in paths containing spaces, and we
still do not correctly resolve the sh executable name as described in
'shell'.
* On Windows, the default value of 'shellslash' is always `false`,
which causes Unix-like shells to interpret `\` in paths returned by
some functions as escape charaters.
Solution:
Use a simple rule table to detect common shells (e.g. `cmd`,
`powershell`, shells whose names contain `csh` or `sh`) and apply
best-effort defaults, while leaving more complex scenarios to user
configuration.
Problem: style: Various lines are indented inconsistently
Solution: Retab these lines and correct some comments.
(zeertzjq)
closes: vim/vim#15259d9be94cf03
Problem: tests: test_restricted() fails
(after: v9.1.0091)
Solution: Add a space before the pipecmd and the actual Vim command to
run
52eb0b8677
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: test_channel may fail because of IPv6 config issues
Solution: Catch and skip the test, if getaddrinfo() fails with
'Address family not supported'
Mark tests as skipped when ch_open encounters E901
On some of the Debian build systems, the IPv6 channel tests fail because
`ch_open('[::1]:<port>', ...)` raises the error "E901: getaddrinfo() in
channel_open(): Address family for hostname not supported".
This appears to happen because getaddrinfo() can't perform the reverse
lookup for the ::1, which is a config issue on that system. Therefore,
instead of reporting a test failure, mark the test as skipped due to the
bad network config
closes: vim/vim#1347343cb8e1c3b
Co-authored-by: James McCoy <jamessan@jamessan.com>
Problem: Test_screenpos() fails intermittently in the GUI testgui CI
job with "Expected {'row': 22} but got {'row': 23}". In the
GUI, the window height reported by getwininfo() before the
final redraw can be stale, so the cached wininfo.height does
not match the actual window height when the assertion runs.
Solution: Use winheight(winid) at assertion time so the height reflects
the window state after the redraw.
closes: vim/vim#20457781a91ac54
Co-authored-by: thinca <thinca@gmail.com>
Problem: A '}' inside a // line comment changes the indentation of the
following line inside an enum or struct (rendcrx).
Solution: Stop scanning the line once a line comment is reached, so a brace
inside the comment is no longer mistaken for an unmatched brace.
fixes: vim/vim#20455closes: vim/vim#204589dd86dff9b
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem: In command-line completion with a popup menu ('wildoptions'
contains "pum"), the info popup shown next to the menu could
not be scrolled, unlike the Insert mode completion info popup
which scrolls with the mouse wheel.
Solution: When the mouse pointer is on top of the info popup, scroll it
with the mouse wheel in command-line mode as well, without
closing the completion popup menu.
closes: vim/vim#20146closes: vim/vim#2041896dbab257a
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem: A needle that only matches past char 1024 gives an INT_MIN + 1
score with unset positions, e.g.
matchfuzzypos([repeat('a',1024)..'z'], 'az').
Solution: Drop the candidate when match_positions() returns SCORE_MIN.
closes: vim/vim#2043552003f7fc1
Problem: Test_statusline() occasionally fails in CI, reading buffer text
instead of the status line (e.g. '9012...' instead of '57,39').
Solution: In s:get_statusline() redraw unconditionally and read the screen
cells directly with screenstring(), instead of relying on
ScreenLines() whose own redraw! can process events and change the
window layout between the redraw and reading the cells. This
matches the already-stable s:Assert_match_statusline() helper in
test_statuslineopt.vim.
closes: vim/vim#20428db3ce018b5
Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Problem: [security]: another possible code execution with python complete
(David Carliez)
Solution: Strip default expressions and annotations from generated
source for pythoncomplete and python3complete.
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-65p9-mwwx-7468c8c63673bc
Co-authored-by: Christian Brabandt <cb@256bit.org>
Problem: srolljump=-100 only scrolls half a page going up, but works
fine going down. update_topline() always falls back to
scroll_cursor_halfway() when the cursor is far above topline.
Solution: Only center when sj is smaller than half the window. Otherwise
call scroll_cursor_top like the downward path does (glepnir).
fixes: vim/vim#1527closes: vim/vim#20366a4a60c0fdb
Problem: After maximizing and deleting the quickfix buffer, window
height is wrong (tertium)
Solution: Reset the winfixheight option when a quickfix buffer is
deleted from a window (Yegappan Lakshmanan)
fixes: vim/vim#3378closes: vim/vim#2040307f055f579
Co-authored-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Problem: Deleting a quickfix line and undoing it leaves the entry
pointing one line below where it should.
Solution: Don't shift already cleared entries in qf_mark_adjust.
closes: vim/vim#2037964982d6010
