diff options
| author | Justin M. Keyes <justinkz@gmail.com> | 2026-08-30 15:50:09 +0200 |
|---|---|---|
| committer | Justin M. Keyes <justinkz@gmail.com> | 2026-08-31 00:16:01 +0200 |
| commit | 25f7c87a702fa246004dad85c93d9df421c22ad1 (patch) | |
| tree | a19f94de0033bc545099b68079385717aaa77cbf /runtime/syntax/python.vim | |
| parent | bc16be3cd91b1d7508f91da97f5c95881eea5fc7 (diff) | |
| download | rneovim-25f7c87a702fa246004dad85c93d9df421c22ad1.tar.gz rneovim-25f7c87a702fa246004dad85c93d9df421c22ad1.tar.bz2 rneovim-25f7c87a702fa246004dad85c93d9df421c22ad1.zip | |
fix(mappings): replaying a deleted Lua mapping is UB
Problem:
Replaying a deleted Lua mapping, may call an arbitrary function.
RHS of a Lua mapping embeds its LuaRef (`<K_LUA><ref><CR>`). The raw
keys may outlive the ref (redobuff ".", CmdAtom `keys`). If the mapping
is deleted, replaying it either (1) dereferences a freed registry slot,
or (2) calls whatever callback reused the slot (autocmd, timer, other
mapping).
Solution:
Assign a monotonic (never recycled) id to Lua mappings and encode the
mapping keys as `<K_LUA><id><CR>`.
Note: in the case of Vimscript, a deleted function raises E117, but if
the function is redefined with the same name, the mapping will find it.
Alternatives?:
- Globally ensure `LuaRef` ids are not recycled.
- Problem: could exhaust `int` in a long-lived Nvim session? Also,
difficult to impl bc the "recycling" is done by `luaL_ref` itself.
ref: 5ac2e47acc999472042df4f10f8f7b5ffa72ba3e
Diffstat (limited to 'runtime/syntax/python.vim')
0 files changed, 0 insertions, 0 deletions