mirror of
https://github.com/neovim/neovim.git
synced 2025-09-19 01:38:16 +00:00

Problem: [security] use-after-free with wildmenu
Solution: properly clean up the wildmenu when exiting
Fix wildchar/wildmenu/pum memory corruption with special wildchar's
Currently, using `wildchar=<Esc>` or `wildchar=<C-\>` can lead to a
memory corruption if using wildmenu+pum, or wrong states if only using
wildmenu. This is due to the code only using one single place inside the
cmdline process loop to perform wild menu clean up (by checking
`end_wildmenu`) but there are other odd situations where the loop could
have exited and we need a post-loop clean up just to be sure. If the
clean up was not done you would have a stale popup menu referring to
invalid memory, or if not using popup menu, incorrect status line (if
`laststatus=0`).
For example, if you hit `<Esc>` two times when it's wildchar, there's a
hard-coded behavior to exit command-line as a failsafe for user, and if
you hit `<C-\><C-\><C-N>` it will also exit command-line, but the clean
up code would not have hit because of specialized `<C-\>` handling.
Fix Ctrl-E / Ctrl-Y to not cancel/accept wildmenu if they are also
used for 'wildchar'/'wildcharm'. Currently they don't behave properly,
and also have potentially memory unsafe behavior as the logic is
currently not accounting for this situation and try to do both.
(Previous patch that addressed this: vim/vim#11677)
Also, correctly document Escape key behavior (double-hit it to escape)
in wildchar docs as it's previously undocumented.
In addition, block known invalid chars to be set in `wildchar` option,
such as Ctrl-C and `<CR>`. This is just to make it clear to the user
they shouldn't be set, and is not required for this bug fix.
closes: vim/vim#13361
8f4fb007e4
Co-authored-by: Yee Cheng Chin <ychin.git@gmail.com>
This directory contains tests for various Vim features. For testing an indent script see runtime/indent/testdir/README.txt. If it makes sense, add a new test method to an already existing file. You may want to separate it from other tests with comment lines. TO ADD A NEW STYLE TEST: 1) Create a test_<subject>.vim file. 2) Add test_<subject>.res to NEW_TESTS_RES in Make_all.mak in alphabetical order. 3) Also add an entry "test_<subject>" to NEW_TESTS in Make_all.mak. 4) Use make test_<subject> to run a single test. At 2), instead of running the test separately, it can be included in "test_alot". Do this for quick tests without side effects. The test runs a bit faster, because Vim doesn't have to be started, one Vim instance runs many tests. At 4), to run a test in GUI, add "GUI_FLAG=-g" to the make command. What you can use (see test_assert.vim for an example): - Call assert_equal(), assert_true(), assert_false(), etc. - Use assert_fails() to check for expected errors. - Use try/catch to avoid an exception aborts the test. - Use test_alloc_fail() to have memory allocation fail. This makes it possible to check memory allocation failures are handled gracefully. You need to change the source code to add an ID to the allocation. Add a new one to alloc_id_T, before aid_last. - Use test_override() to make Vim behave differently, e.g. if char_avail() must return FALSE for a while. E.g. to trigger the CursorMovedI autocommand event. See test_cursor_func.vim for an example. - If the bug that is being tested isn't fixed yet, you can throw an exception with "Skipped" so that it's clear this still needs work. E.g.: throw "Skipped: Bug with <c-e> and popupmenu not fixed yet" - The following environment variables are recognized and can be set to influence the behavior of the test suite (see runtest.vim for details) - $TEST_MAY_FAIL=Test_channel_one - ignore those failing tests - $TEST_FILTER=Test_channel - only run test that match this pattern - $TEST_SKIP_PAT=Test_channel - skip tests that match this pattern - $TEST_NO_RETRY=yes - do not try to re-run failing tests You can also set them in Vim: :let $TEST_MAY_FAIL = 'Test_channel_one' :let $TEST_FILTER = '_set_mode' :let $TEST_SKIP_PAT = 'Test_loop_forever' :let $TEST_NO_RETRY = 'yes' Use an empty string to revert, e.g.: :let $TEST_FILTER = '' - See the start of runtest.vim for more help. TO ADD A SCREEN DUMP TEST: Mostly the same as writing a new style test. Additionally, see help on "terminal-dumptest". Put the reference dump in "dumps/Test_func_name.dump". OLD STYLE TESTS: There are a few tests that are used when Vim was built without the +eval feature. These cannot use the "assert" functions, therefore they consist of a .in file that contains Normal mode commands between STARTTEST and ENDTEST. They modify the file and the result gets written in the test.out file. This is then compared with the .ok file. If they are equal the test passed. If they differ the test failed. RUNNING THE TESTS: To run a single test from the src directory: $ make test_<name> The below commands should be run from the src/testdir directory. To run a single test: $ make test_<name>.res The file 'messages' contains the messages generated by the test script. If a test fails, then the test.log file contains the error messages. If all the tests are successful, then this file will be an empty file. - To run a single test function from a test script: $ ../vim -u NONE -S runtest.vim <test_file>.vim <function_name> - To execute only specific test functions, add a second argument: $ ../vim -u NONE -S runtest.vim test_channel.vim open_delay - To run all the tests: $ make - To run the test on MS-Windows using the MSVC nmake: > nmake -f Make_dos.mak - To run the tests with GUI Vim: $ make GUI_FLAG=-g or $ make VIMPROG=../gvim - To cleanup the temporary files after running the tests: $ make clean