mirror of
https://github.com/neovim/neovim.git
synced 2025-12-14 02:22:49 +00:00
8d8136bfcf
Problem: [security]: use-after-free in ex_substitute
Solution: always allocate memory
closes: vim/vim#13552
A recursive :substitute command could cause a heap-use-after free in Vim
(CVE-2023-48706).
The whole reproducible test is a bit tricky, I can only reproduce this
reliably when no previous substitution command has been used yet
(which is the reason, the test needs to run as first one in the
test_substitute.vim file) and as a combination of the `:~` command
together with a :s command that contains the special substitution atom `~\=`
which will make use of a sub-replace special atom and calls a vim script
function.
There was a comment in the existing :s code, that already makes the
`sub` variable allocate memory so that a recursive :s call won't be able
to cause any issues here, so this was known as a potential problem
already. But for the current test-case that one does not work, because
the substitution does not start with `\=` but with `~\=` (and since
there does not yet exist a previous substitution atom, Vim will simply
increment the `sub` pointer (which then was not allocated dynamically)
and later one happily use a sub-replace special expression (which could
then free the `sub` var).
The following commit fixes this, by making the sub var always using
allocated memory, which also means we need to free the pointer whenever
we leave the function. Since sub is now always an allocated variable,
we also do no longer need the sub_copy variable anymore, since this one
was used to indicated when sub pointed to allocated memory (and had
therefore to be freed on exit) and when not.
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-c8qm-x72m-q53q
26c11c5688
Co-authored-by: Christian Brabandt <cb@256bit.org>
This directory contains tests for various Vim features.
For testing an indent script see runtime/indent/testdir/README.txt.
If it makes sense, add a new test method to an already existing file. You may
want to separate it from other tests with comment lines.
TO ADD A NEW STYLE TEST:
1) Create a test_<subject>.vim file.
2) Add test_<subject>.res to NEW_TESTS_RES in Make_all.mak in alphabetical
order.
3) Also add an entry "test_<subject>" to NEW_TESTS in Make_all.mak.
4) Use make test_<subject> to run a single test.
At 2), instead of running the test separately, it can be included in
"test_alot". Do this for quick tests without side effects. The test runs a
bit faster, because Vim doesn't have to be started, one Vim instance runs many
tests.
At 4), to run a test in GUI, add "GUI_FLAG=-g" to the make command.
What you can use (see test_assert.vim for an example):
- Call assert_equal(), assert_true(), assert_false(), etc.
- Use assert_fails() to check for expected errors.
- Use try/catch to avoid an exception aborts the test.
- Use test_alloc_fail() to have memory allocation fail. This makes it possible
to check memory allocation failures are handled gracefully. You need to
change the source code to add an ID to the allocation. Add a new one to
alloc_id_T, before aid_last.
- Use test_override() to make Vim behave differently, e.g. if char_avail()
must return FALSE for a while. E.g. to trigger the CursorMovedI autocommand
event. See test_cursor_func.vim for an example.
- If the bug that is being tested isn't fixed yet, you can throw an exception
with "Skipped" so that it's clear this still needs work. E.g.: throw
"Skipped: Bug with <c-e> and popupmenu not fixed yet"
- The following environment variables are recognized and can be set to
influence the behavior of the test suite (see runtest.vim for details)
- $TEST_MAY_FAIL=Test_channel_one - ignore those failing tests
- $TEST_FILTER=Test_channel - only run test that match this pattern
- $TEST_SKIP_PAT=Test_channel - skip tests that match this pattern
- $TEST_NO_RETRY=yes - do not try to re-run failing tests
You can also set them in Vim:
:let $TEST_MAY_FAIL = 'Test_channel_one'
:let $TEST_FILTER = '_set_mode'
:let $TEST_SKIP_PAT = 'Test_loop_forever'
:let $TEST_NO_RETRY = 'yes'
Use an empty string to revert, e.g.:
:let $TEST_FILTER = ''
- See the start of runtest.vim for more help.
TO ADD A SCREEN DUMP TEST:
Mostly the same as writing a new style test. Additionally, see help on
"terminal-dumptest". Put the reference dump in "dumps/Test_func_name.dump".
OLD STYLE TESTS:
There are a few tests that are used when Vim was built without the +eval
feature. These cannot use the "assert" functions, therefore they consist of a
.in file that contains Normal mode commands between STARTTEST and ENDTEST.
They modify the file and the result gets written in the test.out file. This
is then compared with the .ok file. If they are equal the test passed. If
they differ the test failed.
RUNNING THE TESTS:
To run a single test from the src directory:
$ make test_<name>
The below commands should be run from the src/testdir directory.
To run a single test:
$ make test_<name>.res
The file 'messages' contains the messages generated by the test script. If a
test fails, then the test.log file contains the error messages. If all the
tests are successful, then this file will be an empty file.
- To run a single test function from a test script:
$ ../vim -u NONE -S runtest.vim <test_file>.vim <function_name>
- To execute only specific test functions, add a second argument:
$ ../vim -u NONE -S runtest.vim test_channel.vim open_delay
- To run all the tests:
$ make
- To run the test on MS-Windows using the MSVC nmake:
> nmake -f Make_dos.mak
- To run the tests with GUI Vim:
$ make GUI_FLAG=-g
or
$ make VIMPROG=../gvim
- To cleanup the temporary files after running the tests:
$ make clean