mirror of
https://github.com/neovim/neovim.git
synced 2025-12-08 07:32:40 +00:00
Problem: [security]: autocmd cause use-after-free in set_curbuf()
(kawarimidoll)
Solution: check side-effect of BufLeave autocommand, when the number
of windows changed, close windows containing buffers that will
be wiped, if curbuf changed unexpectedly make sure b_nwindows
is decremented otherwise it cannot be wiped
set_curbuf() already makes some efforts to ensure the BufLeave
autocommands do not cause issues. However there are still 2 issues
that are not taken care of:
1) If a BufLeave autocommand opens a new window containing the same
buffer as that is going got be closed in close_buffer() a bit later,
we suddenly have another window open, containing a free'd buffer. So we
must check if the number of windows changed and if it does (and the
current buffer is going to be wiped (according to the 'bufhidden'
setting), let's immediately close all windows containing the current
buffer using close_windows()
2) If a BufLeave autocommand changes our current buffer (displays it in
the current window), buf->b_nwindow will be incremented. As part of
set_curbuf() we will however enter another buffer soon, which means, the
newly created curbuf will have b_nwindows still have set, even so the
buffer is no longer displayed in a window. This causes later problems,
because it will no longer be possible to wipe such a buffer. So just
before entering the final buffer, check if the curbuf changed when
calling the BufLeave autocommand and if it does (and curbuf is still
valid), decrement curbuf->b_nwindows.
Both issues can be verified using the provided test (however the second
issue only because such an impacted buffer won't be wiped, causing
futher issues in later tests).
fixes: vim/vim#13839
closes: vim/vim#14104
55f8bba73b
Co-authored-by: Christian Brabandt <cb@256bit.org>
This directory contains tests for various Vim features.
For testing an indent script see runtime/indent/testdir/README.txt.
If it makes sense, add a new test method to an already existing file. You may
want to separate it from other tests with comment lines.
TO ADD A NEW STYLE TEST:
1) Create a test_<subject>.vim file.
2) Add test_<subject>.res to NEW_TESTS_RES in Make_all.mak in alphabetical
order.
3) Also add an entry "test_<subject>" to NEW_TESTS in Make_all.mak.
4) Use make test_<subject> to run a single test.
At 2), instead of running the test separately, it can be included in
"test_alot". Do this for quick tests without side effects. The test runs a
bit faster, because Vim doesn't have to be started, one Vim instance runs many
tests.
At 4), to run a test in GUI, add "GUI_FLAG=-g" to the make command.
What you can use (see test_assert.vim for an example):
- Call assert_equal(), assert_true(), assert_false(), etc.
- Use assert_fails() to check for expected errors.
- Use try/catch to avoid an exception aborts the test.
- Use test_alloc_fail() to have memory allocation fail. This makes it possible
to check memory allocation failures are handled gracefully. You need to
change the source code to add an ID to the allocation. Add a new one to
alloc_id_T, before aid_last.
- Use test_override() to make Vim behave differently, e.g. if char_avail()
must return FALSE for a while. E.g. to trigger the CursorMovedI autocommand
event. See test_cursor_func.vim for an example.
- If the bug that is being tested isn't fixed yet, you can throw an exception
with "Skipped" so that it's clear this still needs work. E.g.: throw
"Skipped: Bug with <c-e> and popupmenu not fixed yet"
- The following environment variables are recognized and can be set to
influence the behavior of the test suite (see runtest.vim for details)
- $TEST_MAY_FAIL=Test_channel_one - ignore those failing tests
- $TEST_FILTER=Test_channel - only run test that match this pattern
- $TEST_SKIP_PAT=Test_channel - skip tests that match this pattern
- $TEST_NO_RETRY=yes - do not try to re-run failing tests
You can also set them in Vim:
:let $TEST_MAY_FAIL = 'Test_channel_one'
:let $TEST_FILTER = '_set_mode'
:let $TEST_SKIP_PAT = 'Test_loop_forever'
:let $TEST_NO_RETRY = 'yes'
Use an empty string to revert, e.g.:
:let $TEST_FILTER = ''
- See the start of runtest.vim for more help.
TO ADD A SCREEN DUMP TEST:
Mostly the same as writing a new style test. Additionally, see help on
"terminal-dumptest". Put the reference dump in "dumps/Test_func_name.dump".
OLD STYLE TESTS:
There are a few tests that are used when Vim was built without the +eval
feature. These cannot use the "assert" functions, therefore they consist of a
.in file that contains Normal mode commands between STARTTEST and ENDTEST.
They modify the file and the result gets written in the test.out file. This
is then compared with the .ok file. If they are equal the test passed. If
they differ the test failed.
RUNNING THE TESTS:
To run a single test from the src directory:
$ make test_<name>
The below commands should be run from the src/testdir directory.
To run a single test:
$ make test_<name>.res
The file 'messages' contains the messages generated by the test script. If a
test fails, then the test.log file contains the error messages. If all the
tests are successful, then this file will be an empty file.
- To run a single test function from a test script:
$ ../vim -u NONE -S runtest.vim <test_file>.vim <function_name>
- To execute only specific test functions, add a second argument:
$ ../vim -u NONE -S runtest.vim test_channel.vim open_delay
- To run all the tests:
$ make
- To run the test on MS-Windows using the MSVC nmake:
> nmake -f Make_dos.mak
- To run the tests with GUI Vim:
$ make GUI_FLAG=-g
or
$ make VIMPROG=../gvim
- To cleanup the temporary files after running the tests:
$ make clean