Mercurial > vim
view src/testdir/test_crash.vim @ 33471:baa62f464436 v9.0.1988
patch 9.0.1988: Vim9: potential use-after-free for class members
Commit: https://github.com/vim/vim/commit/d2f4800099733216e28d59e1a5710f624b0d9ec1
Author: Yegappan Lakshmanan <yegappan@yahoo.com>
Date: Thu Oct 5 20:24:18 2023 +0200
patch 9.0.1988: Vim9: potential use-after-free for class members
Problem: Vim9: potential use-after-free for class members
Solution: Use the class-related grow array for storing the
member type instead of using a temporary type
list grow array
Use the type list grow array associated with the class than using a
temporary type list grow array to allocate the class member type.
For simple types, a predefined type is used. For complex types, the type
is dynamically allocated from a grow array. For class variables, the
type grow array in the class should be used. So that the lifetime of the
type is same as the lifetime of the class.
closes: #13279
Signed-off-by: Christian Brabandt <cb@256bit.org>
Co-authored-by: Yegappan Lakshmanan <yegappan@yahoo.com>
author | Christian Brabandt <cb@256bit.org> |
---|---|
date | Thu, 05 Oct 2023 20:30:11 +0200 |
parents | 25d250a74bb6 |
children | 39b2e200c4d7 |
line wrap: on
line source
" Some tests, that used to crash Vim source check.vim source screendump.vim CheckScreendump func Test_crash1() CheckNotBSD CheckExecutable dash " Test 7 fails on Mac ... CheckNotMac " The following used to crash Vim let opts = #{cmd: 'sh'} let vim = GetVimProg() let buf = RunVimInTerminal('sh', opts) let file = 'crash/poc_huaf1' let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'" let args = printf(cmn_args, vim, file) call term_sendkeys(buf, args .. \ ' && echo "crash 1: [OK]" > X_crash1_result.txt' .. "\<cr>") call TermWait(buf, 50) let file = 'crash/poc_huaf2' let args = printf(cmn_args, vim, file) call term_sendkeys(buf, args .. \ ' && echo "crash 2: [OK]" >> X_crash1_result.txt' .. "\<cr>") call TermWait(buf, 50) let file = 'crash/poc_huaf3' let args = printf(cmn_args, vim, file) call term_sendkeys(buf, args .. \ ' && echo "crash 3: [OK]" >> X_crash1_result.txt' .. "\<cr>") call TermWait(buf, 100) let file = 'crash/bt_quickfix_poc' let args = printf(cmn_args, vim, file) call term_sendkeys(buf, args .. \ ' && echo "crash 4: [OK]" >> X_crash1_result.txt' .. "\<cr>") " clean up call delete('Xerr') " This test takes a bit longer call TermWait(buf, 1000) let file = 'crash/poc_tagfunc.vim' let args = printf(cmn_args, vim, file) " using || because this poc causes vim to exit with exitstatus != 0 call term_sendkeys(buf, args .. \ ' || echo "crash 5: [OK]" >> X_crash1_result.txt' .. "\<cr>") call TermWait(buf, 100) let file = 'crash/bt_quickfix1_poc' let args = printf(cmn_args, vim, file) call term_sendkeys(buf, args .. \ ' && echo "crash 6: [OK]" >> X_crash1_result.txt' .. "\<cr>") " clean up call delete('X') call TermWait(buf, 3000) let file = 'crash/vim_regsub_both_poc' let args = printf(cmn_args, vim, file) call term_sendkeys(buf, args .. \ ' && echo "crash 7: [OK]" >> X_crash1_result.txt' .. "\<cr>") call TermWait(buf, 3000) let file = 'crash/vim_msg_trunc_poc' let args = printf(cmn_args, vim, file) call term_sendkeys(buf, args .. \ ' || echo "crash 8: [OK]" >> X_crash1_result.txt' .. "\<cr>") call TermWait(buf, 3000) " clean up exe buf .. "bw!" sp X_crash1_result.txt let expected = [ \ 'crash 1: [OK]', \ 'crash 2: [OK]', \ 'crash 3: [OK]', \ 'crash 4: [OK]', \ 'crash 5: [OK]', \ 'crash 6: [OK]', \ 'crash 7: [OK]', \ 'crash 8: [OK]', \ ] call assert_equal(expected, getline(1, '$')) bw! call delete('X_crash1_result.txt') endfunc func Test_crash2() " The following used to crash Vim let opts = #{wait_for_ruler: 0, rows: 20} let args = ' -u NONE -i NONE -n -e -s -S ' let buf = RunVimInTerminal(args .. ' crash/vim_regsub_both', opts) call VerifyScreenDump(buf, 'Test_crash_01', {}) exe buf .. "bw!" endfunc " vim: shiftwidth=2 sts=2 expandtab