neovim/test/functional/legacy/crash_spec.lua
zeertzjq 6967c08840 vim-patch:9.1.0648: [security] double-free in dialog_changed()
Problem:  [security] double-free in dialog_changed()
          (SuyueGuo)
Solution: Only clear pointer b_sfname pointer, if it is different
          than the b_ffname pointer.  Don't try to free b_fname,
          set it to NULL instead.

fixes: vim/vim#15403

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-46pw-v7qw-xc2f

b29f4abcd4

Co-authored-by: Christian Brabandt <cb@256bit.org>
2024-08-03 08:25:43 +08:00

66 lines
1.6 KiB
Lua

local t = require('test.testutil')
local n = require('test.functional.testnvim')()
local assert_alive = n.assert_alive
local clear = n.clear
local command = n.command
local eq = t.eq
local eval = n.eval
local exec = n.exec
local feed = n.feed
local pcall_err = t.pcall_err
before_each(clear)
it('no crash when ending Visual mode while editing buffer closes window', function()
command('new')
command('autocmd ModeChanged v:n ++once close')
feed('v')
command('enew')
assert_alive()
end)
it('no crash when ending Visual mode close the window to switch to', function()
command('new')
command('autocmd ModeChanged v:n ++once only')
feed('v')
command('wincmd p')
assert_alive()
end)
it('no crash when truncating overlong message', function()
pcall(command, 'source test/old/testdir/crash/vim_msg_trunc_poc')
assert_alive()
end)
it('no crash with very long option error message', function()
pcall(command, 'source test/old/testdir/crash/poc_did_set_langmap')
assert_alive()
end)
it('no crash when closing window with tag in loclist', function()
exec([[
new
lexpr ['foo']
lopen
let g:qf_bufnr = bufnr()
lclose
call settagstack(1, #{items: [#{tagname: 'foo', from: [g:qf_bufnr, 1, 1, 0]}]})
]])
eq(1, eval('bufexists(g:qf_bufnr)'))
command('1close')
eq(0, eval('bufexists(g:qf_bufnr)'))
assert_alive()
end)
it('no crash when writing "Untitled" file fails', function()
t.mkdir('Untitled')
finally(function()
vim.uv.fs_rmdir('Untitled')
end)
feed('ifoobar')
command('set bufhidden=unload')
eq('Vim(enew):E502: "Untitled" is a directory', pcall_err(command, 'confirm enew'))
assert_alive()
end)