Mercurial > vim
view src/testdir/test_syn_attr.vim @ 33811:06219b3bdaf3 v9.0.2121
patch 9.0.2121: [security]: use-after-free in ex_substitute
Commit: https://github.com/vim/vim/commit/26c11c56888d01e298cd8044caf860f3c26f57bb
Author: Christian Brabandt <cb@256bit.org>
Date: Wed Nov 22 21:26:41 2023 +0100
patch 9.0.2121: [security]: use-after-free in ex_substitute
Problem: [security]: use-after-free in ex_substitute
Solution: always allocate memory
closes: #13552
A recursive :substitute command could cause a heap-use-after free in Vim
(CVE-2023-48706).
The whole reproducible test is a bit tricky, I can only reproduce this
reliably when no previous substitution command has been used yet
(which is the reason, the test needs to run as first one in the
test_substitute.vim file) and as a combination of the `:~` command
together with a :s command that contains the special substitution atom `~\=`
which will make use of a sub-replace special atom and calls a vim script
function.
There was a comment in the existing :s code, that already makes the
`sub` variable allocate memory so that a recursive :s call won't be able
to cause any issues here, so this was known as a potential problem
already. But for the current test-case that one does not work, because
the substitution does not start with `\=` but with `~\=` (and since
there does not yet exist a previous substitution atom, Vim will simply
increment the `sub` pointer (which then was not allocated dynamically)
and later one happily use a sub-replace special expression (which could
then free the `sub` var).
The following commit fixes this, by making the sub var always using
allocated memory, which also means we need to free the pointer whenever
we leave the function. Since sub is now always an allocated variable,
we also do no longer need the sub_copy variable anymore, since this one
was used to indicated when sub pointed to allocated memory (and had
therefore to be freed on exit) and when not.
Github Security Advisory:
https://github.com/vim/vim/security/advisories/GHSA-c8qm-x72m-q53q
Signed-off-by: Christian Brabandt <cb@256bit.org>
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Wed, 22 Nov 2023 22:15:05 +0100 |
| parents | 9b8ab82e3b0b |
| children |
line wrap: on
line source
" Test syntax highlighting functions. func Test_missing_attr() hi Mine term=bold cterm=italic call assert_equal('Mine', synIDattr(hlID("Mine"), "name")) call assert_equal('', synIDattr("Mine"->hlID(), "bg", 'term')) call assert_equal('', synIDattr("Mine"->hlID(), "fg", 'term')) call assert_equal('', synIDattr("Mine"->hlID(), "sp", 'term')) call assert_equal('1', synIDattr(hlID("Mine"), "bold", 'term')) call assert_equal('1', synIDattr(hlID("Mine"), "italic", 'cterm')) hi Mine term=reverse cterm=inverse call assert_equal('1', synIDattr(hlID("Mine"), "reverse", 'term')) call assert_equal('1', synIDattr(hlID("Mine"), "inverse", 'cterm')) hi Mine term=underline cterm=standout gui=undercurl call assert_equal('1', synIDattr(hlID("Mine"), "underline", 'term')) call assert_equal('1', synIDattr(hlID("Mine"), "standout", 'cterm')) call assert_equal('1', synIDattr("Mine"->hlID(), "undercurl", 'gui')) hi Mine term=underdouble cterm=underdotted gui=underdashed call assert_equal('1', synIDattr(hlID("Mine"), "underdouble", 'term')) call assert_equal('1', synIDattr(hlID("Mine"), "underdotted", 'cterm')) call assert_equal('1', synIDattr("Mine"->hlID(), "underdashed", 'gui')) hi Mine term=nocombine gui=strikethrough call assert_equal('1', synIDattr(hlID("Mine"), "strikethrough", 'gui')) call assert_equal('1', synIDattr(hlID("Mine"), "nocombine", 'term')) call assert_equal('', synIDattr(hlID("Mine"), "nocombine", 'gui')) hi Mine term=NONE cterm=NONE gui=NONE call assert_equal('', synIDattr(hlID("Mine"), "bold", 'term')) call assert_equal('', synIDattr(hlID("Mine"), "italic", 'cterm')) call assert_equal('', synIDattr(hlID("Mine"), "reverse", 'term')) call assert_equal('', synIDattr(hlID("Mine"), "inverse", 'cterm')) call assert_equal('', synIDattr(hlID("Mine"), "underline", 'term')) call assert_equal('', synIDattr(hlID("Mine"), "standout", 'cterm')) call assert_equal('', synIDattr(hlID("Mine"), "undercurl", 'gui')) call assert_equal('', synIDattr(hlID("Mine"), "strikethrough", 'gui')) if has('gui') let fontname = getfontname() if fontname == '' let fontname = 'something' endif exe "hi Mine guifg=blue guibg=red font='" . fontname . "'" call assert_equal('blue', synIDattr(hlID("Mine"), "fg", 'gui')) call assert_equal('red', synIDattr(hlID("Mine"), "bg", 'gui')) call assert_equal(fontname, synIDattr(hlID("Mine"), "font", 'gui')) endif endfunc func Test_color_names() let colors = [ \ 'AliceBlue', \ 'AntiqueWhite', \ 'AntiqueWhite1', \ 'AntiqueWhite2', \ 'AntiqueWhite3', \ 'AntiqueWhite4', \ 'BlanchedAlmond', \ 'BlueViolet', \ 'CadetBlue', \ 'CadetBlue1', \ 'CadetBlue2', \ 'CadetBlue3', \ 'CadetBlue4', \ 'CornflowerBlue', \ 'DarkBlue', \ 'DarkCyan', \ 'DarkGoldenrod', \ 'DarkGoldenrod1', \ 'DarkGoldenrod2', \ 'DarkGoldenrod3', \ 'DarkGoldenrod4', \ 'DarkGray', \ 'DarkGreen', \ 'DarkGrey', \ 'DarkKhaki', \ 'DarkMagenta', \ 'DarkOliveGreen', \ 'DarkOliveGreen1', \ 'DarkOliveGreen2', \ 'DarkOliveGreen3', \ 'DarkOliveGreen4', \ 'DarkOrange', \ 'DarkOrange1', \ 'DarkOrange2', \ 'DarkOrange3', \ 'DarkOrange4', \ 'DarkOrchid', \ 'DarkOrchid1', \ 'DarkOrchid2', \ 'DarkOrchid3', \ 'DarkOrchid4', \ 'DarkRed', \ 'DarkSalmon', \ 'DarkSeaGreen', \ 'DarkSeaGreen1', \ 'DarkSeaGreen2', \ 'DarkSeaGreen3', \ 'DarkSeaGreen4', \ 'DarkSlateBlue', \ 'DarkSlateGray', \ 'DarkSlateGray1', \ 'DarkSlateGray2', \ 'DarkSlateGray3', \ 'DarkSlateGray4', \ 'DarkSlateGrey', \ 'DarkTurquoise', \ 'DarkViolet', \ 'DeepPink', \ 'DeepPink1', \ 'DeepPink2', \ 'DeepPink3', \ 'DeepPink4', \ 'DeepSkyBlue', \ 'DeepSkyBlue1', \ 'DeepSkyBlue2', \ 'DeepSkyBlue3', \ 'DeepSkyBlue4', \ 'DimGray', \ 'DimGrey', \ 'DodgerBlue', \ 'DodgerBlue1', \ 'DodgerBlue2', \ 'DodgerBlue3', \ 'DodgerBlue4', \ 'FloralWhite', \ 'ForestGreen', \ 'GhostWhite', \ 'GreenYellow', \ 'HotPink', \ 'HotPink1', \ 'HotPink2', \ 'HotPink3', \ 'HotPink4', \ 'IndianRed', \ 'IndianRed1', \ 'IndianRed2', \ 'IndianRed3', \ 'IndianRed4', \ 'LavenderBlush', \ 'LavenderBlush1', \ 'LavenderBlush2', \ 'LavenderBlush3', \ 'LavenderBlush4', \ 'LawnGreen', \ 'LemonChiffon', \ 'LemonChiffon1', \ 'LemonChiffon2', \ 'LemonChiffon3', \ 'LemonChiffon4', \ 'LightBlue', \ 'LightBlue1', \ 'LightBlue2', \ 'LightBlue3', \ 'LightBlue4', \ 'LightCoral', \ 'LightCyan', \ 'LightCyan1', \ 'LightCyan2', \ 'LightCyan3', \ 'LightCyan4', \ 'LightGoldenrod', \ 'LightGoldenrod1', \ 'LightGoldenrod2', \ 'LightGoldenrod3', \ 'LightGoldenrod4', \ 'LightGoldenrodYellow', \ 'LightGray', \ 'LightGreen', \ 'LightGrey', \ 'LightPink', \ 'LightPink1', \ 'LightPink2', \ 'LightPink3', \ 'LightPink4', \ 'LightSalmon', \ 'LightSalmon1', \ 'LightSalmon2', \ 'LightSalmon3', \ 'LightSalmon4', \ 'LightSeaGreen', \ 'LightSkyBlue', \ 'LightSkyBlue1', \ 'LightSkyBlue2', \ 'LightSkyBlue3', \ 'LightSkyBlue4', \ 'LightSlateBlue', \ 'LightSlateGray', \ 'LightSlateGrey', \ 'LightSteelBlue', \ 'LightSteelBlue1', \ 'LightSteelBlue2', \ 'LightSteelBlue3', \ 'LightSteelBlue4', \ 'LightYellow', \ 'LightYellow1', \ 'LightYellow2', \ 'LightYellow3', \ 'LightYellow4', \ 'LimeGreen', \ 'MediumAquamarine', \ 'MediumBlue', \ 'MediumOrchid', \ 'MediumOrchid1', \ 'MediumOrchid2', \ 'MediumOrchid3', \ 'MediumOrchid4', \ 'MediumPurple', \ 'MediumPurple1', \ 'MediumPurple2', \ 'MediumPurple3', \ 'MediumPurple4', \ 'MediumSeaGreen', \ 'MediumSlateBlue', \ 'MediumSpringGreen', \ 'MediumTurquoise', \ 'MediumVioletRed', \ 'MidnightBlue', \ 'MintCream', \ 'MistyRose', \ 'MistyRose1', \ 'MistyRose2', \ 'MistyRose3', \ 'MistyRose4', \ 'NavajoWhite', \ 'NavajoWhite1', \ 'NavajoWhite2', \ 'NavajoWhite3', \ 'NavajoWhite4', \ 'NavyBlue', \ 'OldLace', \ 'OliveDrab', \ 'OliveDrab1', \ 'OliveDrab2', \ 'OliveDrab3', \ 'OliveDrab4', \ 'OrangeRed', \ 'OrangeRed1', \ 'OrangeRed2', \ 'OrangeRed3', \ 'OrangeRed4', \ 'PaleGoldenrod', \ 'PaleGreen', \ 'PaleGreen1', \ 'PaleGreen2', \ 'PaleGreen3', \ 'PaleGreen4', \ 'PaleTurquoise', \ 'PaleTurquoise1', \ 'PaleTurquoise2', \ 'PaleTurquoise3', \ 'PaleTurquoise4', \ 'PaleVioletRed', \ 'PaleVioletRed1', \ 'PaleVioletRed2', \ 'PaleVioletRed3', \ 'PaleVioletRed4', \ 'PapayaWhip', \ 'PeachPuff', \ 'PeachPuff1', \ 'PeachPuff2', \ 'PeachPuff3', \ 'PeachPuff4', \ 'PowderBlue', \ 'RosyBrown', \ 'RosyBrown1', \ 'RosyBrown2', \ 'RosyBrown3', \ 'RosyBrown4', \ 'RoyalBlue', \ 'RoyalBlue1', \ 'RoyalBlue2', \ 'RoyalBlue3', \ 'RoyalBlue4', \ 'SaddleBrown', \ 'SandyBrown', \ 'SeaGreen', \ 'SeaGreen1', \ 'SeaGreen2', \ 'SeaGreen3', \ 'SeaGreen4', \ 'SkyBlue', \ 'SkyBlue1', \ 'SkyBlue2', \ 'SkyBlue3', \ 'SkyBlue4', \ 'SlateBlue', \ 'SlateBlue1', \ 'SlateBlue2', \ 'SlateBlue3', \ 'SlateBlue4', \ 'SlateGray', \ 'SlateGray1', \ 'SlateGray2', \ 'SlateGray3', \ 'SlateGray4', \ 'SlateGrey', \ 'SpringGreen', \ 'SpringGreen1', \ 'SpringGreen2', \ 'SpringGreen3', \ 'SpringGreen4', \ 'SteelBlue', \ 'SteelBlue1', \ 'SteelBlue2', \ 'SteelBlue3', \ 'SteelBlue4', \ 'VioletRed', \ 'VioletRed1', \ 'VioletRed2', \ 'VioletRed3', \ 'VioletRed4', \ 'WhiteSmoke', \ 'YellowGreen', \ 'alice blue', \ 'antique white', \ 'aquamarine', \ 'aquamarine1', \ 'aquamarine2', \ 'aquamarine3', \ 'aquamarine4', \ 'azure', \ 'azure1', \ 'azure2', \ 'azure3', \ 'azure4', \ 'beige', \ 'bisque', \ 'bisque1', \ 'bisque2', \ 'bisque3', \ 'bisque4', \ 'black', \ 'blanched almond', \ 'blue violet', \ 'blue', \ 'blue1', \ 'blue2', \ 'blue3', \ 'blue4', \ 'brown', \ 'brown1', \ 'brown2', \ 'brown3', \ 'brown4', \ 'burlywood', \ 'burlywood1', \ 'burlywood2', \ 'burlywood3', \ 'burlywood4', \ 'cadet blue', \ 'chartreuse', \ 'chartreuse1', \ 'chartreuse2', \ 'chartreuse3', \ 'chartreuse4', \ 'chocolate', \ 'chocolate1', \ 'chocolate2', \ 'chocolate3', \ 'chocolate4', \ 'coral', \ 'coral1', \ 'coral2', \ 'coral3', \ 'coral4', \ 'cornflower blue', \ 'cornsilk', \ 'cornsilk1', \ 'cornsilk2', \ 'cornsilk3', \ 'cornsilk4', \ 'cyan', \ 'cyan1', \ 'cyan2', \ 'cyan3', \ 'cyan4', \ 'dark blue', \ 'dark cyan', \ 'dark goldenrod', \ 'dark gray', \ 'dark green', \ 'dark grey', \ 'dark khaki', \ 'dark magenta', \ 'dark olive green', \ 'dark orange', \ 'dark orchid', \ 'dark red', \ 'dark salmon', \ 'dark sea green', \ 'dark slate blue', \ 'dark slate gray', \ 'dark slate grey', \ 'dark turquoise', \ 'dark violet', \ 'darkblue', \ 'darkcyan', \ 'darkgray', \ 'darkgreen', \ 'darkgrey', \ 'darkmagenta', \ 'darkred', \ 'darkyellow', \ 'deep pink', \ 'deep sky blue', \ 'dim gray', \ 'dim grey', \ 'dodger blue', \ 'firebrick', \ 'firebrick1', \ 'firebrick2', \ 'firebrick3', \ 'firebrick4', \ 'floral white', \ 'forest green', \ 'gainsboro', \ 'ghost white', \ 'gold', \ 'gold1', \ 'gold2', \ 'gold3', \ 'gold4', \ 'goldenrod', \ 'goldenrod1', \ 'goldenrod2', \ 'goldenrod3', \ 'goldenrod4', \ 'gray', \ 'gray0', \ 'gray1', \ 'gray10', \ 'gray100', \ 'gray11', \ 'gray12', \ 'gray13', \ 'gray14', \ 'gray15', \ 'gray16', \ 'gray17', \ 'gray18', \ 'gray19', \ 'gray2', \ 'gray20', \ 'gray21', \ 'gray22', \ 'gray23', \ 'gray24', \ 'gray25', \ 'gray26', \ 'gray27', \ 'gray28', \ 'gray29', \ 'gray3', \ 'gray30', \ 'gray31', \ 'gray32', \ 'gray33', \ 'gray34', \ 'gray35', \ 'gray36', \ 'gray37', \ 'gray38', \ 'gray39', \ 'gray4', \ 'gray40', \ 'gray41', \ 'gray42', \ 'gray43', \ 'gray44', \ 'gray45', \ 'gray46', \ 'gray47', \ 'gray48', \ 'gray49', \ 'gray5', \ 'gray50', \ 'gray51', \ 'gray52', \ 'gray53', \ 'gray54', \ 'gray55', \ 'gray56', \ 'gray57', \ 'gray58', \ 'gray59', \ 'gray6', \ 'gray60', \ 'gray61', \ 'gray62', \ 'gray63', \ 'gray64', \ 'gray65', \ 'gray66', \ 'gray67', \ 'gray68', \ 'gray69', \ 'gray7', \ 'gray70', \ 'gray71', \ 'gray72', \ 'gray73', \ 'gray74', \ 'gray75', \ 'gray76', \ 'gray77', \ 'gray78', \ 'gray79', \ 'gray8', \ 'gray80', \ 'gray81', \ 'gray82', \ 'gray83', \ 'gray84', \ 'gray85', \ 'gray86', \ 'gray87', \ 'gray88', \ 'gray89', \ 'gray9', \ 'gray90', \ 'gray91', \ 'gray92', \ 'gray93', \ 'gray94', \ 'gray95', \ 'gray96', \ 'gray97', \ 'gray98', \ 'gray99', \ 'green yellow', \ 'green', \ 'green1', \ 'green2', \ 'green3', \ 'green4', \ 'grey', \ 'grey0', \ 'grey1', \ 'grey10', \ 'grey100', \ 'grey11', \ 'grey12', \ 'grey13', \ 'grey14', \ 'grey15', \ 'grey16', \ 'grey17', \ 'grey18', \ 'grey19', \ 'grey2', \ 'grey20', \ 'grey21', \ 'grey22', \ 'grey23', \ 'grey24', \ 'grey25', \ 'grey26', \ 'grey27', \ 'grey28', \ 'grey29', \ 'grey3', \ 'grey30', \ 'grey31', \ 'grey32', \ 'grey33', \ 'grey34', \ 'grey35', \ 'grey36', \ 'grey37', \ 'grey38', \ 'grey39', \ 'grey4', \ 'grey40', \ 'grey41', \ 'grey42', \ 'grey43', \ 'grey44', \ 'grey45', \ 'grey46', \ 'grey47', \ 'grey48', \ 'grey49', \ 'grey5', \ 'grey50', \ 'grey51', \ 'grey52', \ 'grey53', \ 'grey54', \ 'grey55', \ 'grey56', \ 'grey57', \ 'grey58', \ 'grey59', \ 'grey6', \ 'grey60', \ 'grey61', \ 'grey62', \ 'grey63', \ 'grey64', \ 'grey65', \ 'grey66', \ 'grey67', \ 'grey68', \ 'grey69', \ 'grey7', \ 'grey70', \ 'grey71', \ 'grey72', \ 'grey73', \ 'grey74', \ 'grey75', \ 'grey76', \ 'grey77', \ 'grey78', \ 'grey79', \ 'grey8', \ 'grey80', \ 'grey81', \ 'grey82', \ 'grey83', \ 'grey84', \ 'grey85', \ 'grey86', \ 'grey87', \ 'grey88', \ 'grey89', \ 'grey9', \ 'grey90', \ 'grey91', \ 'grey92', \ 'grey93', \ 'grey94', \ 'grey95', \ 'grey96', \ 'grey97', \ 'grey98', \ 'grey99', \ 'honeydew', \ 'honeydew1', \ 'honeydew2', \ 'honeydew3', \ 'honeydew4', \ 'hot pink', \ 'indian red', \ 'ivory', \ 'ivory1', \ 'ivory2', \ 'ivory3', \ 'ivory4', \ 'khaki', \ 'khaki1', \ 'khaki2', \ 'khaki3', \ 'khaki4', \ 'lavender blush', \ 'lavender', \ 'lawn green', \ 'lemon chiffon', \ 'light blue', \ 'light coral', \ 'light cyan', \ 'light goldenrod yellow', \ 'light goldenrod', \ 'light gray', \ 'light green', \ 'light grey', \ 'light pink', \ 'light salmon', \ 'light sea green', \ 'light sky blue', \ 'light slate blue', \ 'light slate gray', \ 'light slate grey', \ 'light steel blue', \ 'light yellow', \ 'lightblue', \ 'lightcyan', \ 'lightgray', \ 'lightgreen', \ 'lightgrey', \ 'lightmagenta', \ 'lightred', \ 'lightyellow', \ 'lime green', \ 'linen', \ 'magenta', \ 'magenta1', \ 'magenta2', \ 'magenta3', \ 'magenta4', \ 'maroon', \ 'maroon1', \ 'maroon2', \ 'maroon3', \ 'maroon4', \ 'medium aquamarine', \ 'medium blue', \ 'medium orchid', \ 'medium purple', \ 'medium sea green', \ 'medium slate blue', \ 'medium spring green', \ 'medium turquoise', \ 'medium violet red', \ 'midnight blue', \ 'mint cream', \ 'misty rose', \ 'moccasin', \ 'navajo white', \ 'navy blue', \ 'navy', \ 'old lace', \ 'olive drab', \ 'orange red', \ 'orange', \ 'orange1', \ 'orange2', \ 'orange3', \ 'orange4', \ 'orchid', \ 'orchid1', \ 'orchid2', \ 'orchid3', \ 'orchid4', \ 'pale goldenrod', \ 'pale green', \ 'pale turquoise', \ 'pale violet red', \ 'papaya whip', \ 'peach puff', \ 'peru', \ 'pink', \ 'pink1', \ 'pink2', \ 'pink3', \ 'pink4', \ 'plum', \ 'plum1', \ 'plum2', \ 'plum3', \ 'plum4', \ 'powder blue', \ 'purple', \ 'purple1', \ 'purple2', \ 'purple3', \ 'purple4', \ 'red', \ 'red1', \ 'red2', \ 'red3', \ 'red4', \ 'rosy brown', \ 'royal blue', \ 'saddle brown', \ 'salmon', \ 'salmon1', \ 'salmon2', \ 'salmon3', \ 'salmon4', \ 'sandy brown', \ 'sea green', \ 'seagreen', \ 'seashell', \ 'seashell1', \ 'seashell2', \ 'seashell3', \ 'seashell4', \ 'sienna', \ 'sienna1', \ 'sienna2', \ 'sienna3', \ 'sienna4', \ 'sky blue', \ 'slate blue', \ 'slate gray', \ 'slate grey', \ 'slateblue', \ 'snow', \ 'snow1', \ 'snow2', \ 'snow3', \ 'snow4', \ 'spring green', \ 'steel blue', \ 'tan', \ 'tan1', \ 'tan2', \ 'tan3', \ 'tan4', \ 'thistle', \ 'thistle1', \ 'thistle2', \ 'thistle3', \ 'thistle4', \ 'tomato', \ 'tomato1', \ 'tomato2', \ 'tomato3', \ 'tomato4', \ 'turquoise', \ 'turquoise1', \ 'turquoise2', \ 'turquoise3', \ 'turquoise4', \ 'violet red', \ 'violet', \ 'wheat', \ 'wheat1', \ 'wheat2', \ 'wheat3', \ 'wheat4', \ 'white smoke', \ 'white', \ 'yellow green', \ 'yellow', \ 'yellow1', \ 'yellow2', \ 'yellow3', \ 'yellow4', \ ] for color in colors " just test that the color name can be found. exe "hi Mine guifg='" . color . "'" endfor " case is ignored hi Mine guifg=blanchedalmond hi Mine guifg=BLANCHEDALMOND endfunc " vim: shiftwidth=2 sts=2 expandtab