Files
neovim/test/old/testdir
zeertzjq e715122e4e vim-patch:9.2.0725: [security]: Stack out-of-bounds write in spell_soundfold_sal() (#40402)
Problem:  [security]: A crafted spell file with non-collapsing SAL rules
          can make soundfold() write one byte past the end of the
          MAXWLEN result buffer.  This is the same class of
          out-of-bounds write as GHSA-q8mh-6qm3-25g4 (fixed in 9.2.0698
          for the SOFO branch), found while auditing the surrounding
          code.
Solution: Bound the single-byte SAL result writes and the terminating
          NUL to MAXWLEN - 1, matching the SOFO branch.

The single-byte branch of spell_soundfold_sal() guarded its writes with
"reslen < MAXWLEN", allowing reslen to reach MAXWLEN (254).  The trailing
"res[reslen] = NUL" then wrote at index 254 of the 254-byte stack buffer
res[MAXWLEN], an off-by-one out-of-bounds write.  Input is case-folded to
about 253 characters, so a 253-character argument together with a SAL map
that does not collapse (collapse_result false) reaches the boundary.

Related to previous issue
[GHSA-q8mh-6qm3-25g4](https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4)
(9.2.0698)

Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-m3hf-xcm3-xhm2

d22ff1c955

This is N/A as Nvim doesn't have spell_soundfold_sal() which is only
used in the !has_mbyte code path.

Co-authored-by: Hirohito Higashi <h.east.727@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-25 00:17:38 +00:00
..
2026-03-29 13:36:56 +02:00
2024-04-23 18:17:04 +02:00
2026-01-07 08:11:42 +08:00
2026-04-01 07:59:51 +08:00
2024-03-28 09:32:32 +08:00

This directory contains tests for various Vim features.
For testing an indent script see runtime/indent/testdir/README.txt.

If it makes sense, add a new test method to an already existing file.  You may
want to separate it from other tests with comment lines.

TO ADD A NEW STYLE TEST:

1) Create a test_<subject>.vim file.
2) Add test_<subject>.res to NEW_TESTS_RES in Make_all.mak in alphabetical
   order.
3) Also add an entry "test_<subject>" to NEW_TESTS in Make_all.mak.
4) Use make test_<subject> to run a single test.

At 2), instead of running the test separately, it can be included in
"test_alot".  Do this for quick tests without side effects.  The test runs a
bit faster, because Vim doesn't have to be started, one Vim instance runs many
tests.

At 4), to run a test in GUI, add "GUI_FLAG=-g" to the make command.


What you can use (see test_assert.vim for an example):

- Call assert_equal(), assert_true(), assert_false(), etc.

- Use assert_fails() to check for expected errors.

- Use try/catch to avoid an exception aborts the test.

- Use test_alloc_fail() to have memory allocation fail.  This makes it possible
  to check memory allocation failures are handled gracefully.  You need to
  change the source code to add an ID to the allocation.  Add a new one to
  alloc_id_T, before aid_last.

- Use test_override() to make Vim behave differently, e.g.  if char_avail()
  must return FALSE for a while.  E.g. to trigger the CursorMovedI autocommand
  event. See test_cursor_func.vim for an example.

- If the bug that is being tested isn't fixed yet, you can throw an exception
  with "Skipped" so that it's clear this still needs work.  E.g.: throw
  "Skipped: Bug with <c-e> and popupmenu not fixed yet"

- The following environment variables are recognized and can be set to
  influence the behavior of the test suite (see runtest.vim for details)

  - $TEST_MAY_FAIL=Test_channel_one    - ignore those failing tests
  - $TEST_FILTER=Test_channel    - only run test that match this pattern
  - $TEST_SKIP_PAT=Test_channel  - skip tests that match this pattern
  - $TEST_NO_RETRY=yes           - do not try to re-run failing tests
  You can also set them in Vim:
    :let $TEST_MAY_FAIL = 'Test_channel_one'
    :let $TEST_FILTER = '_set_mode'
    :let $TEST_SKIP_PAT = 'Test_loop_forever'
    :let $TEST_NO_RETRY = 'yes'
  Use an empty string to revert, e.g.:
    :let $TEST_FILTER = ''

- See the start of runtest.vim for more help.


TO ADD A SCREEN DUMP TEST:

Mostly the same as writing a new style test.  Additionally, see help on
"terminal-dumptest".  Put the reference dump in "dumps/Test_func_name.dump".


OLD STYLE TESTS:

There are a few tests that are used when Vim was built without the +eval
feature.  These cannot use the "assert" functions, therefore they consist of a
.in file that contains Normal mode commands between STARTTEST and ENDTEST.
They modify the file and the result gets written in the test.out file.  This
is then compared with the .ok file.  If they are equal the test passed.  If
they differ the test failed.


RUNNING THE TESTS:

To run a single test from the src directory:

    $ make test_<name>

The below commands should be run from the src/testdir directory.

To run a single test:

    $ make test_<name>.res

The file 'messages' contains the messages generated by the test script.  If a
test fails, then the test.log file contains the error messages.  If all the
tests are successful, then this file will be an empty file.

- To run a single test function from a test script:

    $ ../vim -u NONE -S runtest.vim <test_file>.vim <function_name>

- To execute only specific test functions, add a second argument:

	 $ ../vim -u NONE -S runtest.vim test_channel.vim open_delay


- To run all the tests:

    $ make

- To run the test on MS-Windows using the MSVC nmake:

    > nmake -f Make_dos.mak

- To run the tests with GUI Vim:

    $ make GUI_FLAG=-g

    or

    $ make VIMPROG=../gvim

- To cleanup the temporary files after running the tests:

    $ make clean