Mercurial > vim
annotate src/testdir/test_tab.vim @ 33811:06219b3bdaf3 v9.0.2121
patch 9.0.2121: [security]: use-after-free in ex_substitute
Commit: https://github.com/vim/vim/commit/26c11c56888d01e298cd8044caf860f3c26f57bb
Author: Christian Brabandt <cb@256bit.org>
Date: Wed Nov 22 21:26:41 2023 +0100
patch 9.0.2121: [security]: use-after-free in ex_substitute
Problem: [security]: use-after-free in ex_substitute
Solution: always allocate memory
closes: #13552
A recursive :substitute command could cause a heap-use-after free in Vim
(CVE-2023-48706).
The whole reproducible test is a bit tricky, I can only reproduce this
reliably when no previous substitution command has been used yet
(which is the reason, the test needs to run as first one in the
test_substitute.vim file) and as a combination of the `:~` command
together with a :s command that contains the special substitution atom `~\=`
which will make use of a sub-replace special atom and calls a vim script
function.
There was a comment in the existing :s code, that already makes the
`sub` variable allocate memory so that a recursive :s call won't be able
to cause any issues here, so this was known as a potential problem
already. But for the current test-case that one does not work, because
the substitution does not start with `\=` but with `~\=` (and since
there does not yet exist a previous substitution atom, Vim will simply
increment the `sub` pointer (which then was not allocated dynamically)
and later one happily use a sub-replace special expression (which could
then free the `sub` var).
The following commit fixes this, by making the sub var always using
allocated memory, which also means we need to free the pointer whenever
we leave the function. Since sub is now always an allocated variable,
we also do no longer need the sub_copy variable anymore, since this one
was used to indicated when sub pointed to allocated memory (and had
therefore to be freed on exit) and when not.
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-c8qm-x72m-q53q
Signed-off-by: Christian Brabandt <cb@256bit.org>
author | Christian Brabandt <cb@256bit.org> |
---|---|
date | Wed, 22 Nov 2023 22:15:05 +0100 |
parents | 08940efa6b4e |
children |
rev | line source |
---|---|
14243
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
1 " Various tests for inserting a Tab. |
12686
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
2 |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
3 " Tests for "r<Tab>" with 'smarttab' and 'expandtab' set/not set. |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
4 " Also test that dv_ works correctly |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
5 func Test_smarttab() |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
6 enew! |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
7 set smarttab expandtab ts=8 sw=4 |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
8 " make sure that backspace works, no matter what termcap is used |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
9 exe "set t_kD=\<C-V>x7f t_kb=\<C-V>x08" |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
10 call append(0, ['start text', |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
11 \ "\t\tsome test text", |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
12 \ 'test text', |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
13 \ "\t\tother test text", |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
14 \ ' a cde', |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
15 \ ' f ghi', |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
16 \ 'test text', |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
17 \ ' Second line beginning with whitespace' |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
18 \ ]) |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
19 call cursor(1, 1) |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
20 exe "normal /some\<CR>" |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
21 exe "normal r\t" |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
22 call assert_equal("\t\t ome test text", getline('.')) |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
23 set noexpandtab |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
24 exe "normal /other\<CR>" |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
25 exe "normal r\t" |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
26 call assert_equal("\t\t ther test text", getline('.')) |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
27 |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
28 " Test replacing with Tabs and then backspacing to undo it |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
29 exe "normal j0wR\t\t\t\<BS>\<BS>\<BS>" |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
30 call assert_equal(" a cde", getline('.')) |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
31 " Test replacing with Tabs |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
32 exe "normal j0wR\t\t\t" |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
33 call assert_equal(" \t\thi", getline('.')) |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
34 |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
35 " Test that copyindent works with expandtab set |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
36 set expandtab smartindent copyindent ts=8 sw=8 sts=8 |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
37 exe "normal jo{\<CR>x" |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
38 call assert_equal('{', getline(line('.') - 1)) |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
39 call assert_equal(' x', getline('.')) |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
40 set nosol |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
41 exe "normal /Second line/\<CR>" |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
42 exe "normal fwdv_" |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
43 call assert_equal(' with whitespace', getline('.')) |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
44 enew! |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
45 set expandtab& smartindent& copyindent& ts& sw& sts& |
aa658b33f25a
patch 8.0.1221: still too many old style tests
Christian Brabandt <cb@256bit.org>
parents:
diff
changeset
|
46 endfunc |
14243
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
47 |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
48 func Test_softtabstop() |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
49 new |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
50 set sts=0 sw=0 |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
51 exe "normal ix\<Tab>x\<Esc>" |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
52 call assert_equal("x\tx", getline(1)) |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
53 |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
54 call setline(1, '') |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
55 set sts=4 |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
56 exe "normal ix\<Tab>x\<Esc>" |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
57 call assert_equal("x x", getline(1)) |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
58 |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
59 call setline(1, '') |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
60 set sts=-1 sw=4 |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
61 exe "normal ix\<Tab>x\<Esc>" |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
62 call assert_equal("x x", getline(1)) |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
63 |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
64 call setline(1, 'x ') |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
65 set sts=0 sw=0 backspace=start |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
66 exe "normal A\<BS>x\<Esc>" |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
67 call assert_equal("x x", getline(1)) |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
68 |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
69 call setline(1, 'x ') |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
70 set sts=4 |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
71 exe "normal A\<BS>x\<Esc>" |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
72 call assert_equal("x x", getline(1)) |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
73 |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
74 call setline(1, 'x ') |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
75 set sts=-1 sw=4 |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
76 exe "normal A\<BS>x\<Esc>" |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
77 call assert_equal("x x", getline(1)) |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
78 |
14276
752ef53d3731
patch 8.1.0154: crash with "set smarttab shiftwidth=0 softtabstop=-1"
Christian Brabandt <cb@256bit.org>
parents:
14243
diff
changeset
|
79 call setline(1, 'x') |
752ef53d3731
patch 8.1.0154: crash with "set smarttab shiftwidth=0 softtabstop=-1"
Christian Brabandt <cb@256bit.org>
parents:
14243
diff
changeset
|
80 set sts=-1 sw=0 smarttab |
752ef53d3731
patch 8.1.0154: crash with "set smarttab shiftwidth=0 softtabstop=-1"
Christian Brabandt <cb@256bit.org>
parents:
14243
diff
changeset
|
81 exe "normal I\<Tab>\<Esc>" |
752ef53d3731
patch 8.1.0154: crash with "set smarttab shiftwidth=0 softtabstop=-1"
Christian Brabandt <cb@256bit.org>
parents:
14243
diff
changeset
|
82 call assert_equal("\tx", getline(1)) |
752ef53d3731
patch 8.1.0154: crash with "set smarttab shiftwidth=0 softtabstop=-1"
Christian Brabandt <cb@256bit.org>
parents:
14243
diff
changeset
|
83 |
752ef53d3731
patch 8.1.0154: crash with "set smarttab shiftwidth=0 softtabstop=-1"
Christian Brabandt <cb@256bit.org>
parents:
14243
diff
changeset
|
84 call setline(1, 'x') |
752ef53d3731
patch 8.1.0154: crash with "set smarttab shiftwidth=0 softtabstop=-1"
Christian Brabandt <cb@256bit.org>
parents:
14243
diff
changeset
|
85 exe "normal I\<Tab>\<BS>\<Esc>" |
752ef53d3731
patch 8.1.0154: crash with "set smarttab shiftwidth=0 softtabstop=-1"
Christian Brabandt <cb@256bit.org>
parents:
14243
diff
changeset
|
86 call assert_equal("x", getline(1)) |
752ef53d3731
patch 8.1.0154: crash with "set smarttab shiftwidth=0 softtabstop=-1"
Christian Brabandt <cb@256bit.org>
parents:
14243
diff
changeset
|
87 |
752ef53d3731
patch 8.1.0154: crash with "set smarttab shiftwidth=0 softtabstop=-1"
Christian Brabandt <cb@256bit.org>
parents:
14243
diff
changeset
|
88 set sts=0 sw=0 backspace& nosmarttab |
14243
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
89 bwipe! |
fbf0681606fa
patch 8.1.0138: negative value of 'softtabstop' not used correctly
Christian Brabandt <cb@256bit.org>
parents:
12686
diff
changeset
|
90 endfunc |
21765
08940efa6b4e
patch 8.2.1432: various inconsistencies in test files
Bram Moolenaar <Bram@vim.org>
parents:
14276
diff
changeset
|
91 |
08940efa6b4e
patch 8.2.1432: various inconsistencies in test files
Bram Moolenaar <Bram@vim.org>
parents:
14276
diff
changeset
|
92 " vim: shiftwidth=2 sts=2 expandtab |