Mercurial > vim
view src/testdir/test_search_stat.vim @ 33811:06219b3bdaf3 v9.0.2121
patch 9.0.2121: [security]: use-after-free in ex_substitute
Commit: https://github.com/vim/vim/commit/26c11c56888d01e298cd8044caf860f3c26f57bb
Author: Christian Brabandt <cb@256bit.org>
Date: Wed Nov 22 21:26:41 2023 +0100
patch 9.0.2121: [security]: use-after-free in ex_substitute
Problem: [security]: use-after-free in ex_substitute
Solution: always allocate memory
closes: #13552
A recursive :substitute command could cause a heap-use-after free in Vim
(CVE-2023-48706).
The whole reproducible test is a bit tricky, I can only reproduce this
reliably when no previous substitution command has been used yet
(which is the reason, the test needs to run as first one in the
test_substitute.vim file) and as a combination of the `:~` command
together with a :s command that contains the special substitution atom `~\=`
which will make use of a sub-replace special atom and calls a vim script
function.
There was a comment in the existing :s code, that already makes the
`sub` variable allocate memory so that a recursive :s call won't be able
to cause any issues here, so this was known as a potential problem
already. But for the current test-case that one does not work, because
the substitution does not start with `\=` but with `~\=` (and since
there does not yet exist a previous substitution atom, Vim will simply
increment the `sub` pointer (which then was not allocated dynamically)
and later one happily use a sub-replace special expression (which could
then free the `sub` var).
The following commit fixes this, by making the sub var always using
allocated memory, which also means we need to free the pointer whenever
we leave the function. Since sub is now always an allocated variable,
we also do no longer need the sub_copy variable anymore, since this one
was used to indicated when sub pointed to allocated memory (and had
therefore to be freed on exit) and when not.
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-c8qm-x72m-q53q
Signed-off-by: Christian Brabandt <cb@256bit.org>
author | Christian Brabandt <cb@256bit.org> |
---|---|
date | Wed, 22 Nov 2023 22:15:05 +0100 |
parents | 695b50472e85 |
children |
line wrap: on
line source
" Tests for search_stats, when "S" is not in 'shortmess' source check.vim source screendump.vim func Test_search_stat() new set shortmess-=S " Append 50 lines with text to search for, "foobar" appears 20 times call append(0, repeat(['foobar', 'foo', 'fooooobar', 'foba', 'foobar'], 10)) call cursor(1, 1) " searchcount() returns an empty dictionary when previous pattern was not set call assert_equal({}, searchcount(#{pattern: ''})) " but setting @/ should also work (even 'n' nor 'N' was executed) " recompute the count when the last position is different. call assert_equal( \ #{current: 1, exact_match: 1, total: 40, incomplete: 0, maxcount: 99}, \ searchcount(#{pattern: 'foo'})) call assert_equal( \ #{current: 0, exact_match: 0, total: 10, incomplete: 0, maxcount: 99}, \ searchcount(#{pattern: 'fooooobar'})) call assert_equal( \ #{current: 0, exact_match: 0, total: 10, incomplete: 0, maxcount: 99}, \ searchcount(#{pattern: 'fooooobar', pos: [2, 1, 0]})) call assert_equal( \ #{current: 1, exact_match: 1, total: 10, incomplete: 0, maxcount: 99}, \ searchcount(#{pattern: 'fooooobar', pos: [3, 1, 0]})) " on last char of match call assert_equal( \ #{current: 1, exact_match: 1, total: 10, incomplete: 0, maxcount: 99}, \ searchcount(#{pattern: 'fooooobar', pos: [3, 9, 0]})) " on char after match call assert_equal( \ #{current: 1, exact_match: 0, total: 10, incomplete: 0, maxcount: 99}, \ searchcount(#{pattern: 'fooooobar', pos: [3, 10, 0]})) call assert_equal( \ #{current: 1, exact_match: 0, total: 10, incomplete: 0, maxcount: 99}, \ searchcount(#{pattern: 'fooooobar', pos: [4, 1, 0]})) call assert_equal( \ #{current: 1, exact_match: 0, total: 2, incomplete: 2, maxcount: 1}, \ searchcount(#{pattern: 'fooooobar', pos: [4, 1, 0], maxcount: 1})) call assert_equal( \ #{current: 0, exact_match: 0, total: 2, incomplete: 2, maxcount: 1}, \ searchcount(#{pattern: 'fooooobar', maxcount: 1})) " match at second line let messages_before = execute('messages') let @/ = 'fo*\(bar\?\)\?' let g:a = execute(':unsilent :norm! n') let stat = '\[2/50\]' let pat = escape(@/, '()*?'). '\s\+' call assert_match(pat .. stat, g:a) call assert_equal( \ #{current: 2, exact_match: 1, total: 50, incomplete: 0, maxcount: 99}, \ searchcount(#{recompute: 0})) " didn't get added to message history call assert_equal(messages_before, execute('messages')) " Match at last line call cursor(line('$')-2, 1) let g:a = execute(':unsilent :norm! n') let stat = '\[50/50\]' call assert_match(pat .. stat, g:a) call assert_equal( \ #{current: 50, exact_match: 1, total: 50, incomplete: 0, maxcount: 99}, \ searchcount(#{recompute: 0})) " No search stat set shortmess+=S call cursor(1, 1) let stat = '\[2/50\]' let g:a = execute(':unsilent :norm! n') call assert_notmatch(pat .. stat, g:a) " n does not update search stat call assert_equal( \ #{current: 50, exact_match: 1, total: 50, incomplete: 0, maxcount: 99}, \ searchcount(#{recompute: 0})) call assert_equal( \ #{current: 2, exact_match: 1, total: 50, incomplete: 0, maxcount: 99}, \ searchcount(#{recompute: v:true})) set shortmess-=S " Many matches call cursor(line('$')-2, 1) let @/ = '.' let pat = escape(@/, '()*?'). '\s\+' let g:a = execute(':unsilent :norm! n') let stat = '\[>99/>99\]' call assert_match(pat .. stat, g:a) call assert_equal( \ #{current: 100, exact_match: 0, total: 100, incomplete: 2, maxcount: 99}, \ searchcount(#{recompute: 0})) call assert_equal( \ #{current: 272, exact_match: 1, total: 280, incomplete: 0, maxcount: 0}, \ searchcount(#{recompute: v:true, maxcount: 0, timeout: 200})) call assert_equal( \ #{current: 1, exact_match: 1, total: 280, incomplete: 0, maxcount: 0}, \ searchcount(#{recompute: 1, maxcount: 0, pos: [1, 1, 0], timeout: 200})) call cursor(line('$'), 1) let g:a = execute(':unsilent :norm! n') let stat = 'W \[1/>99\]' call assert_match(pat .. stat, g:a) call assert_equal( \ #{current: 1, exact_match: 1, total: 100, incomplete: 2, maxcount: 99}, \ searchcount(#{recompute: 0})) call assert_equal( \ #{current: 1, exact_match: 1, total: 280, incomplete: 0, maxcount: 0}, \ searchcount(#{recompute: 1, maxcount: 0, timeout: 200})) call assert_equal( \ #{current: 271, exact_match: 1, total: 280, incomplete: 0, maxcount: 0}, \ searchcount(#{recompute: 1, maxcount: 0, pos: [line('$')-2, 1, 0], timeout: 200})) " Many matches call cursor(1, 1) let g:a = execute(':unsilent :norm! n') let stat = '\[2/>99\]' call assert_match(pat .. stat, g:a) call cursor(1, 1) let g:a = execute(':unsilent :norm! N') let stat = 'W \[>99/>99\]' call assert_match(pat .. stat, g:a) " right-left if exists("+rightleft") set rl call cursor(1,1) let @/ = 'foobar' let pat = 'raboof/\s\+' let g:a = execute(':unsilent :norm! n') let stat = '\[20/2\]' call assert_match(pat .. stat, g:a) set norl endif " right-left bottom if exists("+rightleft") set rl call cursor('$',1) let pat = 'raboof?\s\+' let g:a = execute(':unsilent :norm! N') let stat = '\[20/20\]' call assert_match(pat .. stat, g:a) set norl endif " right-left back at top if exists("+rightleft") set rl call cursor('$',1) let pat = 'raboof/\s\+' let g:a = execute(':unsilent :norm! n') let stat = 'W \[20/1\]' call assert_match(pat .. stat, g:a) set norl endif " normal, back at bottom call cursor(1,1) let @/ = 'foobar' let pat = '?foobar\s\+' let g:a = execute(':unsilent :norm! N') let stat = 'W \[20/20\]' call assert_match(pat .. stat, g:a) call assert_match('W \[20/20\]', Screenline(&lines)) " normal, no match call cursor(1,1) let @/ = 'zzzzzz' let g:a = '' try let g:a = execute(':unsilent :norm! n') catch /^Vim\%((\a\+)\)\=:E486/ let stat = '' " error message is not redir'ed to g:a, it is empty call assert_true(empty(g:a)) catch call assert_false(1) endtry " with count call cursor(1, 1) let @/ = 'fo*\(bar\?\)\?' let g:a = execute(':unsilent :norm! 2n') let stat = '\[3/50\]' let pat = escape(@/, '()*?'). '\s\+' call assert_match(pat .. stat, g:a) let g:a = execute(':unsilent :norm! 2n') let stat = '\[5/50\]' call assert_match(pat .. stat, g:a) " with offset call cursor(1, 1) call feedkeys("/fo*\\(bar\\?\\)\\?/+1\<cr>", 'tx') let g:a = execute(':unsilent :norm! n') let stat = '\[5/50\]' let pat = escape(@/ .. '/+1', '()*?'). '\s\+' call assert_match(pat .. stat, g:a) " normal, n comes from a mapping " Need to move over more than 64 lines to trigger char_avail(. nnoremap n nzv call cursor(1,1) call append(50, repeat(['foobar', 'foo', 'fooooobar', 'foba', 'foobar'], 10)) call setline(2, 'find this') call setline(70, 'find this') let @/ = 'find this' let pat = '/find this\s\+' let g:a = execute(':unsilent :norm n') " g:a will contain several lines let g:b = split(g:a, "\n")[-1] let stat = '\[1/2\]' call assert_match(pat .. stat, g:b) unmap n " normal, but silent call cursor(1,1) let @/ = 'find this' let pat = '/find this\s\+' let g:a = execute(':norm! n') let stat = '\[1/2\]' call assert_notmatch(pat .. stat, g:a) " normal, n comes from a silent mapping " First test a normal mapping, then a silent mapping call cursor(1,1) nnoremap n n let @/ = 'find this' let pat = '/find this\s\+' let g:a = execute(':unsilent :norm n') let g:b = split(g:a, "\n")[-1] let stat = '\[1/2\]' call assert_match(pat .. stat, g:b) nnoremap <silent> n n call cursor(1,1) let g:a = execute(':unsilent :norm n') let g:b = split(g:a, "\n")[-1] let stat = '\[1/2\]' call assert_notmatch(pat .. stat, g:b) call assert_match(stat, g:b) " Test that the message is not truncated " it would insert '...' into the output. call assert_match('^\s\+' .. stat, g:b) unmap n " Time out %delete _ call append(0, repeat(['foobar', 'foo', 'fooooobar', 'foba', 'foobar'], 100000)) call cursor(1, 1) call assert_equal(1, searchcount(#{pattern: 'foo', maxcount: 0, timeout: 1}).incomplete) " Clean up set shortmess+=S " close the window bwipe! endfunc func Test_searchcount_fails() call assert_fails('echo searchcount("boo!")', 'E1206:') call assert_fails('echo searchcount({"timeout" : []})', 'E745:') call assert_fails('echo searchcount({"maxcount" : []})', 'E745:') call assert_fails('echo searchcount({"pattern" : []})', 'E730:') call assert_fails('echo searchcount({"pos" : 1})', 'E475:') call assert_fails('echo searchcount({"pos" : [1]})', 'E475:') call assert_fails('echo searchcount({"pos" : [[], 2, 3]})', 'E745:') call assert_fails('echo searchcount({"pos" : [1, [], 3]})', 'E745:') call assert_fails('echo searchcount({"pos" : [1, 2, []]})', 'E745:') endfunc func Test_search_stat_narrow_screen() " This used to crash Vim let save_columns = &columns try let after =<< trim [CODE] set laststatus=2 set columns=16 set shortmess-=S showcmd call setline(1, 'abc') call feedkeys("/abc\<CR>:quit!\<CR>") autocmd VimLeavePre * call writefile(["done"], "Xdone") [CODE] if !RunVim([], after, '--clean') return endif call assert_equal("done", readfile("Xdone")[0]) call delete('Xdone') finally let &columns = save_columns endtry endfunc func Test_searchcount_in_statusline() CheckScreendump let lines =<< trim END set shortmess-=S call append(0, 'this is something') function TestSearchCount() abort let search_count = searchcount() if !empty(search_count) return '[' . search_count.current . '/' . search_count.total . ']' else return '' endif endfunction set hlsearch set laststatus=2 statusline+=%{TestSearchCount()} END call writefile(lines, 'Xsearchstatusline', 'D') let buf = RunVimInTerminal('-S Xsearchstatusline', #{rows: 10}) call TermWait(buf) call term_sendkeys(buf, "/something") call VerifyScreenDump(buf, 'Test_searchstat_4', {}) call term_sendkeys(buf, "\<Esc>") call StopVimInTerminal(buf) endfunc func Test_search_stat_foldopen() CheckScreendump let lines =<< trim END set shortmess-=S setl foldenable foldmethod=indent foldopen-=search call append(0, ['if', "\tfoo", "\tfoo", 'endif']) let @/ = 'foo' call cursor(1,1) norm n END call writefile(lines, 'Xsearchstat1', 'D') let buf = RunVimInTerminal('-S Xsearchstat1', #{rows: 10}) call VerifyScreenDump(buf, 'Test_searchstat_3', {}) call term_sendkeys(buf, "n") call VerifyScreenDump(buf, 'Test_searchstat_3', {}) call term_sendkeys(buf, "n") call VerifyScreenDump(buf, 'Test_searchstat_3', {}) call StopVimInTerminal(buf) endfunc func! Test_search_stat_screendump() CheckScreendump let lines =<< trim END set shortmess-=S " Append 50 lines with text to search for, "foobar" appears 20 times call append(0, repeat(['foobar', 'foo', 'fooooobar', 'foba', 'foobar'], 20)) call setline(2, 'find this') call setline(70, 'find this') nnoremap n n let @/ = 'find this' call cursor(1,1) norm n END call writefile(lines, 'Xsearchstat', 'D') let buf = RunVimInTerminal('-S Xsearchstat', #{rows: 10}) call VerifyScreenDump(buf, 'Test_searchstat_1', {}) call term_sendkeys(buf, ":nnoremap <silent> n n\<cr>") call term_sendkeys(buf, "gg0n") call VerifyScreenDump(buf, 'Test_searchstat_2', {}) call StopVimInTerminal(buf) endfunc func Test_search_stat_then_gd() CheckScreendump let lines =<< trim END call setline(1, ['int cat;', 'int dog;', 'cat = dog;']) set shortmess-=S set hlsearch END call writefile(lines, 'Xsearchstatgd', 'D') let buf = RunVimInTerminal('-S Xsearchstatgd', #{rows: 10}) call term_sendkeys(buf, "/dog\<CR>") call VerifyScreenDump(buf, 'Test_searchstatgd_1', {}) call term_sendkeys(buf, "G0gD") call VerifyScreenDump(buf, 'Test_searchstatgd_2', {}) call StopVimInTerminal(buf) endfunc func Test_search_stat_and_incsearch() CheckScreendump let lines =<< trim END call setline(1, ['abc--c', '--------abc', '--abc']) set hlsearch set incsearch set bg=dark set showtabline=2 function MyTabLine() try let a=searchcount(#{recompute: 1, maxcount: -1}) return a.current .. '/' .. a.total catch return '' endtry endfunction set tabline=%!MyTabLine() END call writefile(lines, 'Xsearchstat_inc', 'D') let buf = RunVimInTerminal('-S Xsearchstat_inc', #{rows: 10}) call term_sendkeys(buf, "/abc") call TermWait(buf) call VerifyScreenDump(buf, 'Test_searchstat_inc_1', {}) call term_sendkeys(buf, "\<c-g>") call TermWait(buf) call VerifyScreenDump(buf, 'Test_searchstat_inc_2', {}) call term_sendkeys(buf, "\<c-g>") call TermWait(buf) call VerifyScreenDump(buf, 'Test_searchstat_inc_3', {}) call term_sendkeys(buf, "\<esc>:qa\<cr>") call TermWait(buf) call StopVimInTerminal(buf) endfunc func Test_search_stat_backwards() CheckScreendump let lines =<< trim END set shm-=S call setline(1, ['test', '']) END call writefile(lines, 'Xsearchstat_back', 'D') let buf = RunVimInTerminal('-S Xsearchstat_back', #{rows: 10}) call term_sendkeys(buf, "*") call TermWait(buf) call VerifyScreenDump(buf, 'Test_searchstat_back_1', {}) call term_sendkeys(buf, "N") call TermWait(buf) call VerifyScreenDump(buf, 'Test_searchstat_back_2', {}) call term_sendkeys(buf, ":set shm+=S\<cr>N") call TermWait(buf) " shows "Search Hit Bottom.." call VerifyScreenDump(buf, 'Test_searchstat_back_3', {}) call term_sendkeys(buf, "\<esc>:qa\<cr>") call TermWait(buf) call StopVimInTerminal(buf) endfunc " vim: shiftwidth=2 sts=2 expandtab