aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
...
| * | | | | | | | refactor: remove unused file ringbuf.hdundargoc2023-12-02
| |/ / / / / / /
| * / / / / / / build(nix): update flake.lockJosé Luis Lafuente2023-12-02
| |/ / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Flake lock file updates: • Updated input 'flake-utils': 'github:numtide/flake-utils/a1720a10a6cfe8234c0e93907ffe81be440f4cef' (2023-05-31) → 'github:numtide/flake-utils/ff7b65b44d01cf9ba6a71320833626af21126384' (2023-09-12) • Updated input 'nixpkgs': 'github:nixos/nixpkgs/a64b73e07d4aa65cfcbda29ecf78eaf9e72e44bd' (2023-06-08) → 'github:nixos/nixpkgs/e92039b55bcd58469325ded85d4f58dd5a4eaf58' (2023-11-29)
| * | | | | | Merge pull request #26358 from zeertzjq/vim-9.0.2140zeertzjq2023-12-02
| |\ \ \ \ \ \ | | | | | | | | | | | | | | | | vim-patch:9.0.{2140,2141,2142,2143}
| | * | | | | | vim-patch:9.0.2143: [security]: buffer-overflow in ex_substitutezeertzjq2023-12-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: [security]: buffer-overflow in ex_substitute Solution: clear memory after allocating When allocating the new_start pointer in ex_substitute() the memory pointer points to some garbage that the following for loop in ex_cmds.c:4743 confuses and causes it to accessing the new_start pointer beyond it's size, leading to a buffer-overlow. So fix this by using alloc_clear() instead of alloc(), which will clear the memory by NUL and therefore cause the loop to terminate correctly. Reported by @henices, thanks! closes: vim/vim#13596 https://github.com/vim/vim/commit/abfa13ebe92d81aaf66669c428d767847b577453 Co-authored-by: Christian Brabandt <cb@256bit.org>
| | * | | | | | vim-patch:9.0.2142: [security]: stack-buffer-overflow in option callback ↵zeertzjq2023-12-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | functions Problem: [security]: stack-buffer-overflow in option callback functions Solution: pass size of errbuf down the call stack, use snprintf() instead of sprintf() We pass the error buffer down to the option callback functions, but in some parts of the code, we simply use sprintf(buf) to write into the error buffer, which can overflow. So let's pass down the length of the error buffer and use sprintf(buf, size) instead. Reported by @henices, thanks! https://github.com/vim/vim/commit/b39b240c386a5a29241415541f1c99e2e6b8ce47 Co-authored-by: Christian Brabandt <cb@256bit.org>
| | * | | | | | vim-patch:9.0.2141: [security]: buffer-overflow in suggest_trie_walkzeertzjq2023-12-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: [security]: buffer-overflow in suggest_trie_walk Solution: Check n before using it as index into byts array Basically, n as an index into the byts array, can point to beyond the byts array. So let's double check, that n is within the expected range after incrementing it from sp->ts_curi and bail out if it would be invalid. Reported by @henices, thanks! https://github.com/vim/vim/commit/0fb375aae608d7306b4baf9c1f906961f32e2abf Co-authored-by: Christian Brabandt <cb@256bit.org>
| | * | | | | | vim-patch:9.0.2140: [security]: use-after-free in win-enterzeertzjq2023-12-02
| |/ / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: [security]: use-after-free in win-enter Solution: validate window pointer before calling win_enter() win_goto() may stop visual mode, if it is active. However, this may in turn trigger the ModeChanged autocommand, which could potentially free the wp pointer which was valid before now became stale and points to now freed memory. So before calling win_enter(), let's verify one more time, that the wp pointer still points to a valid window structure. Reported by @henices, thanks! https://github.com/vim/vim/commit/eec0c2b3a4cfab93dd8d4adaa60638d47a2bbc8a Co-authored-by: Christian Brabandt <cb@256bit.org>
| * | | | | | revert: "memory: Free buffers after freeing variables" (#26356)zeertzjq2023-12-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit fe30d8ccef17fff23676b8670dfec86444e2cb32. The original commit intends to prevent heap-use-after-free with EXITFREE caused by changedtick_di, which is no longer a problem. Freeing buffers after freeing variables will cause heap-use-after-free with EXITFREE when a partial is used as prompt callback.
| * | | | | | vim-patch:9.0.2139: html.angular ft is problematic (#26357)zeertzjq2023-12-02
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: html.angular ft is problematic Solution: partly revert v9.0.2137 The html.angular filetype causes issues and does not trigger FileType autocommands for the html or angular filetypes. So let's roll back that particular change and detect this only as html file related: https://github.com/vim/vim/pull/13594#issuecomment-1834465890 closes: vim/vim#13604 https://github.com/vim/vim/commit/4f3480c94358e3b938594fc3574477e780525cd7 Co-authored-by: Christian Brabandt <cb@256bit.org>
| * | | | | | refactor: free more reachable memory with EXITFREE (#26349)zeertzjq2023-12-02
| | | | | | | | | | | | | | | | | | | | | Discovered using __sanitizer_print_memory_profile().
| * | | | | | refactor: remove kbtree.hdundargoc2023-12-01
| | | | | | |
| * | | | | | refactor: remove SIZEOF_INT checkdundargoc2023-12-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I have not seen any indication that this is a problem tha can occur with cmake.
| * | | | | | ci: create setup actiondundargoc2023-12-01
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This deduplicates common operations.
| * | | | | | refactor: move float_relative_str[] to nvim_win_get_config() (#26344)zeertzjq2023-12-01
| | | | | | | | | | | | | | | | | | | | | It's only used in one place, as it's usually conveyed as non-string.
| * | | | | | refactor: change event_create() to a macro (#26343)zeertzjq2023-12-01
| | | | | | | | | | | | | | | | | | | | | A varargs functions can never be inlined, so a macro is faster.
| * | | | | | fix(api): use a conditional stack for nvim_cmd (#26341)zeertzjq2023-12-01
| | | | | | |
| * | | | | | refactor(IWYU): fix includes for highlight_group.h (#26340)zeertzjq2023-12-01
| | | | | | |
| * | | | | | refactor(IWYU): create {ex_getln,rbuffer,os/fileio}_defs.h (#26338)zeertzjq2023-12-01
| | | | | | |
| * | | | | | fix: use BEL to terminate OSC 11 request (#26335)Gregory Anders2023-11-30
| | | | | | |
| * | | | | | Merge pull request #25870 from dundargoc/build/libtermkeyGregory Anders2023-11-30
| |\ \ \ \ \ \ | | | | | | | | | | | | | | | | build: vendor libtermkey
| | * | | | | | docs: update MAINTAIN.mdGregory Anders2023-11-30
| | | | | | | |
| | * | | | | | fix(termkey): include IO header on WindowsGregory Anders2023-11-30
| | | | | | | |
| | * | | | | | fix(termkey): accept BEL (0x07) as OSC terminatorGregory Anders2023-11-30
| | | | | | | |
| | * | | | | | fix(termkey): do not sign extend mode valueGregory Anders2023-11-30
| | | | | | | |
| | * | | | | | build: vendor libtermkeydundargoc2023-11-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a proof of concept/WIP to evaluate the viability of vendoring libtermkey as it's been deprecated.
| * | | | | | | vim-patch:9.0.2137: Can't detect angular & mustache filetypesObserverOfTime2023-11-30
| |/ / / / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem: Can't detect angular & mustache filetypes Solution: Detect *.mustache as Mustache filetype; detect *.component.html as html.angular filetype closes: vim/vim#13594 https://github.com/vim/vim/commit/7bed263c343c62129c5d8f51796895a28db1b312
| * | | | | | refactor: explicitly abort on OOM condition (#26330)Gregory Anders2023-11-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | assert() would not abort in release builds, meaning an OOM condition would be undetected.
| * | | | | | fix: Remove nested for_each_tree in TSTreeView (#26328)Pham Huy Hoang2023-11-30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |<