Mercurial > vim

comparison src/testdir/test_cmdline.vim @ 33581:403d57b06231 v9.0.2035

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
patch 9.0.2035: [security] use-after-free with wildmenu Commit: https://github.com/vim/vim/commit/8f4fb007e4d472b09ff6bed9ffa485e0c3093699 Author: Yee Cheng Chin <ychin.git@gmail.com> Date: Tue Oct 17 10:06:56 2023 +0200 patch 9.0.2035: [security] use-after-free with wildmenu Problem: [security] use-after-free with wildmenu Solution: properly clean up the wildmenu when exiting Fix wildchar/wildmenu/pum memory corruption with special wildchar's Currently, using `wildchar=<Esc>` or `wildchar=<C-\>` can lead to a memory corruption if using wildmenu+pum, or wrong states if only using wildmenu. This is due to the code only using one single place inside the cmdline process loop to perform wild menu clean up (by checking `end_wildmenu`) but there are other odd situations where the loop could have exited and we need a post-loop clean up just to be sure. If the clean up was not done you would have a stale popup menu referring to invalid memory, or if not using popup menu, incorrect status line (if `laststatus=0`). For example, if you hit `<Esc>` two times when it's wildchar, there's a hard-coded behavior to exit command-line as a failsafe for user, and if you hit `<C-\><C-\><C-N>` it will also exit command-line, but the clean up code would not have hit because of specialized `<C-\>` handling. Fix Ctrl-E / Ctrl-Y to not cancel/accept wildmenu if they are also used for 'wildchar'/'wildcharm'. Currently they don't behave properly, and also have potentially memory unsafe behavior as the logic is currently not accounting for this situation and try to do both. (Previous patch that addressed this: #11677) Also, correctly document Escape key behavior (double-hit it to escape) in wildchar docs as it's previously undocumented. In addition, block known invalid chars to be set in `wildchar` option, such as Ctrl-C and `<CR>`. This is just to make it clear to the user they shouldn't be set, and is not required for this bug fix. closes: #13361 Signed-off-by: Christian Brabandt <cb@256bit.org> Co-authored-by: Yee Cheng Chin <ychin.git@gmail.com>
author Christian Brabandt <cb@256bit.org>
date Tue, 17 Oct 2023 10:15:08 +0200
parents 46d449fd4fe4
children e628d7f03758
comparison
equal deleted inserted replaced
33580:c6adca2035dc 33581:403d57b06231
169 let lines =<< trim [SCRIPT] 169 let lines =<< trim [SCRIPT]
170 set wildmenu hlsearch 170 set wildmenu hlsearch
171 [SCRIPT] 171 [SCRIPT]
172 call writefile(lines, 'XTest_wildmenu', 'D') 172 call writefile(lines, 'XTest_wildmenu', 'D')
173 173
174 " Test simple wildmenu
174 let buf = RunVimInTerminal('-S XTest_wildmenu', {'rows': 8}) 175 let buf = RunVimInTerminal('-S XTest_wildmenu', {'rows': 8})
175 call term_sendkeys(buf, ":vim\<Tab>") 176 call term_sendkeys(buf, ":vim\<Tab>")
176 call VerifyScreenDump(buf, 'Test_wildmenu_1', {}) 177 call VerifyScreenDump(buf, 'Test_wildmenu_1', {})
177 178
178 call term_sendkeys(buf, "\<Tab>") 179 call term_sendkeys(buf, "\<Tab>")
179 call VerifyScreenDump(buf, 'Test_wildmenu_2', {}) 180 call VerifyScreenDump(buf, 'Test_wildmenu_2', {})
180 181
181 call term_sendkeys(buf, "\<Tab>") 182 call term_sendkeys(buf, "\<Tab>")
182 call VerifyScreenDump(buf, 'Test_wildmenu_3', {}) 183 call VerifyScreenDump(buf, 'Test_wildmenu_3', {})
183 184
185 " Looped back to the original value
184 call term_sendkeys(buf, "\<Tab>\<Tab>") 186 call term_sendkeys(buf, "\<Tab>\<Tab>")
185 call VerifyScreenDump(buf, 'Test_wildmenu_4', {}) 187 call VerifyScreenDump(buf, 'Test_wildmenu_4', {})
188
189 " Test that the wild menu is cleared properly
190 call term_sendkeys(buf, " ")
191 call VerifyScreenDump(buf, 'Test_wildmenu_5', {})
192
193 " Test that a different wildchar still works
194 call term_sendkeys(buf, "\<Esc>:set wildchar=<Esc>\<CR>")
195 call term_sendkeys(buf, ":vim\<Esc>")
196 call VerifyScreenDump(buf, 'Test_wildmenu_1', {})
197
198 " Double-<Esc> is a hard-coded method to escape while wildchar=<Esc>. Make
199 " sure clean up is properly done in edge case like this.
186 call term_sendkeys(buf, "\<Esc>") 200 call term_sendkeys(buf, "\<Esc>")
201 call VerifyScreenDump(buf, 'Test_wildmenu_6', {})
187 202
188 " clean up 203 " clean up
189 call StopVimInTerminal(buf) 204 call StopVimInTerminal(buf)
190 endfunc 205 endfunc
191 206
2634 call VerifyScreenDump(buf, 'Test_wildmenu_pum_term_01', {}) 2649 call VerifyScreenDump(buf, 'Test_wildmenu_pum_term_01', {})
2635 call term_wait(buf) 2650 call term_wait(buf)
2636 call StopVimInTerminal(buf) 2651 call StopVimInTerminal(buf)
2637 endfunc 2652 endfunc
2638 2653
2639 func Test_wildmenu_pum_clear_entries() 2654 func Test_wildmenu_pum_odd_wildchar()
2640 CheckRunVimInTerminal 2655 CheckRunVimInTerminal
2641 2656
2642 " This was using freed memory. Run in a terminal to get the pum to update. 2657 " Test odd wildchar interactions with pum. Make sure they behave properly
2658 " and don't lead to memory corruption due to improperly cleaned up memory.
2643 let lines =<< trim END 2659 let lines =<< trim END
2644 set wildoptions=pum 2660 set wildoptions=pum
2645 set wildchar=<C-E> 2661 set wildchar=<C-E>
2646 END 2662 END
2647 call writefile(lines, 'XwildmenuTest', 'D') 2663 call writefile(lines, 'XwildmenuTest', 'D')
2648 let buf = RunVimInTerminal('-S XwildmenuTest', #{rows: 10}) 2664 let buf = RunVimInTerminal('-S XwildmenuTest', #{rows: 10})
2649 2665
2650 call term_sendkeys(buf, ":\<C-E>\<C-E>") 2666 call term_sendkeys(buf, ":\<C-E>")
2651 call VerifyScreenDump(buf, 'Test_wildmenu_pum_clear_entries_1', {}) 2667 call VerifyScreenDump(buf, 'Test_wildmenu_pum_odd_wildchar_1', {})
2652 2668
2653 set wildoptions& wildchar& 2669 " <C-E> being a wildchar takes priority over its original functionality
2670 call term_sendkeys(buf, "\<C-E>")
2671 call VerifyScreenDump(buf, 'Test_wildmenu_pum_odd_wildchar_2', {})
2672
2673 call term_sendkeys(buf, "\<Esc>")
2674 call VerifyScreenDump(buf, 'Test_wildmenu_pum_odd_wildchar_3', {})
2675
2676 " Escape key can be wildchar too. Double-<Esc> is hard-coded to escape
2677 " command-line, and we need to make sure to clean up properly.
2678 call term_sendkeys(buf, ":set wildchar=<Esc>\<CR>")
2679 call term_sendkeys(buf, ":\<Esc>")
2680 call VerifyScreenDump(buf, 'Test_wildmenu_pum_odd_wildchar_1', {})
2681
2682 call term_sendkeys(buf, "\<Esc>")
2683 call VerifyScreenDump(buf, 'Test_wildmenu_pum_odd_wildchar_3', {})
2684
2685 " <C-\> can also be wildchar. <C-\><C-N> however will still escape cmdline
2686 " and we again need to make sure we clean up properly.
2687 call term_sendkeys(buf, ":set wildchar=<C-\\>\<CR>")
2688 call term_sendkeys(buf, ":\<C-\>\<C-\>")
2689 call VerifyScreenDump(buf, 'Test_wildmenu_pum_odd_wildchar_1', {})
2690
2691 call term_sendkeys(buf, "\<C-N>")
2692 call VerifyScreenDump(buf, 'Test_wildmenu_pum_odd_wildchar_3', {})
2693
2694 call StopVimInTerminal(buf)
2654 endfunc 2695 endfunc
2655 2696
2656 " Test for completion after a :substitute command followed by a pipe (|) 2697 " Test for completion after a :substitute command followed by a pipe (|)
2657 " character 2698 " character
2658 func Test_cmdline_complete_substitute() 2699 func Test_cmdline_complete_substitute()