view src/testdir/test_vim9_fails.vim @ 33802:b857615e5d42 v9.0.2117

patch 9.0.2117: [security] use-after-free in qf_free_items Commit: https://github.com/vim/vim/commit/567cae2630a51efddc07eacff3b38a295e1f5671 Author: Christian Brabandt <cb@256bit.org> Date: Sun Nov 19 16:19:27 2023 +0100 patch 9.0.2117: [security] use-after-free in qf_free_items Problem: [security] use-after-free in qf_free_items Solution: only access qfpnext, if it hasn't been freed Coverity discovered a possible use-after-free in qf_free_items. When freeing the qfline items, we may access freed memory, when qfp == qfpnext. So only access qfpnext, when it hasn't been freed. Signed-off-by: Christian Brabandt <cb@256bit.org>
author Christian Brabandt <cb@256bit.org>
date Tue, 21 Nov 2023 20:15:05 +0100
parents 54e36d01847b
children
line wrap: on
line source

" Test for Vim9 script with failures, causing memory leaks to be reported.
" The leaks happen after a fork() and can be ignored.

source check.vim

def Test_assignment()
  if !has('channel')
    CheckFeature channel
  else
    var chan1: channel
    var job1: job
    var job2: job = job_start('willfail')
  endif
enddef

" Unclear why this test causes valgrind to report problems.
def Test_job_info_return_type()
  if !has('job')
    CheckFeature job
  else
    var job: job = job_start(&shell)
    var jobs = job_info()
    assert_equal('list<job>', typename(jobs))
    assert_equal('dict<any>', typename(job_info(jobs[0])))
    job_stop(job)
  endif
enddef

" Using "idx" from a legacy global function does not work.
" This caused a crash when called from legacy context.
" This creates a dict that contains a partial that refers to the dict, causing
" valgrind to report "possibly leaked memory".
func Test_partial_call_fails()
  let lines =<< trim END
      vim9script

      var l = ['a', 'b', 'c']
      def Iter(container: any): any
        var idx = -1
        var obj = {state: container}
        def g:NextItem__(self: dict<any>): any
          ++idx
          return self.state[idx]
        enddef
        obj.__next__ = function('g:NextItem__', [obj])
        return obj
      enddef

      var it = Iter(l)
      echo it.__next__()
  END
  call writefile(lines, 'XpartialCall', 'D')
  let caught = 'no'
  try
    source XpartialCall
  catch /E1248:/
    let caught = 'yes'
  endtry
  call assert_equal('yes', caught)
  delfunc g:NextItem__
endfunc