Commit Graph

8775 Commits

Author SHA1 Message Date
Francisco Giordano
c124594b22 fix(api): buffer overflow in nvim_buf_get_extmarks overlap #37184
With `overlap=true`, more extmarks than the requested limit may be
collected in `extmark_get`. This then leads to an out of bounds write of
`rv` in `nvim_buf_get_extmarks`.

(cherry picked from commit 612cd99a00)
2026-01-02 07:37:32 +00:00
zeertzjq
44eae48b75 vim-patch:9.1.0893: No test that undofile format does not regress (#37193)
Problem:  No test that undofile format does not regress
Solution: include a sample undofile to make sure we are always able to
          read it

This is so, that we don't unintentionally change the undofile format and
make sure we can load an undo file that has been created by an older
Vim.

closes: vim/vim#16127

14382c8bc9

Convert the undo file in samples/ using method from #13973.

Co-authored-by: Christian Brabandt <cb@256bit.org>
(cherry picked from commit 94f7302e66)
2026-01-01 23:40:43 +00:00
zeertzjq
fda8d2c717 vim-patch:9.1.2028: [security]: Buffer-overflow with incomplete multi-byte chars (#37133)
Problem:  Buffer overflow in buf_write() when converting incomplete
          multi-byte characters (Kevin Goodsell)
Solution: Make the buffer slightly larger

closes: vim/vim#19007

f99de42a9f

Co-authored-by: Christian Brabandt <cb@256bit.org>
(cherry picked from commit 444e1ffe3e)
2025-12-28 01:05:55 +00:00
zeertzjq
18f189a3f3 test(api/server_requests_spec): fix flaky test (again) (#37100)
(cherry picked from commit b7adf8081c)
2025-12-26 02:25:00 +00:00
Sean Dewar
648cf4e586 fix(autocmd): skip empty comma-separated patterns properly
Problem: empty comma-separated patterns in an aupat aren't skipped correctly.
Solution: skip consecutive commas in an aupat.

Also simplify the logic.

(cherry picked from commit 1cde71233f)
2025-12-26 02:21:20 +00:00
Sean Dewar
bea500dbeb fix(autocmd): parsing of comma-separated buflocal patterns
Problem: patterns after a buffer-local pattern in a comma-separated aupat are
         ignored.
Solution: ensure pat refers to the original buffer after each pattern, not the
          buflocal_pat buffer, and when printing make sure it's normalized for
          each pattern, not just the first.

Also simplify the logic when printing all autocommands for an event, and ensure
headings aren't repeated for each event when printing autocommands.

(cherry picked from commit 6d2330f50d)
2025-12-26 02:21:20 +00:00
zeertzjq
fcdc984188 test(ui/inccommand_spec): don't check for transient message (#37078)
The check for v:errmsg is enough.

(cherry picked from commit c374d78095)
2025-12-23 01:01:42 +00:00
Sean Dewar
6338d2d54b fix(window): win_move_after UAF from naughty autocmds (#37065)
Problem: use-after-free in win_move_after if win_enter autocommands free win1/2.
Solution: set w_pos_changed before calling win_enter.

(cherry picked from commit d1189ea508, also adding
an import of "exec" in the test)
2025-12-22 09:38:38 +00:00
Jaehwang Jung
124c18261c fix(marks): wrong line('w$', win) with conceal_lines (#37047)
Background:
Suppose a window has concealed lines, and sets conceallevel>2,
concealcursor="". The concealed lines are displayed if the window is
curwin and the cursor is on the those lines.

Problem:
line('w$', win) switches curwin to win, and then does validate_botline
for curwin. It computes botline assuming the concealed lines displayed,
resulting in a smaller value than the actual botline that the user sees.

Solution:
Evaluate line('w$', win) without switching curwin.
Apply similar changes to other functions that switches curwin.

Co-authored-by: zeertzjq <zeertzjq@outlook.com>
(cherry picked from commit 033f1123cd)
2025-12-22 09:29:41 +00:00
zeertzjq
275c769f01 fix(lua): don't remove first char of non-file stacktrace source (#37008) 2025-12-18 08:57:33 +08:00
zeertzjq
6f84ea7c66 fix(buffer): switching buffer should respect jumpoptions+=view (#36969)
Also add missing change to buflist_findfmark() from #19224.

(cherry picked from commit 2700f6642a)
2025-12-15 07:40:48 +00:00
zeertzjq
a66fce6fab vim-patch:98a0cbf: patch 9.1.1971: crash with invalid positional argument 0 in printf() (#36919)
Problem:  crash with invalid positional argument 0 in printf()
Solution: Reject positional arguments <= 0.

closes: vim/vim#18898

98a0cbf05b

Co-authored-by: Christian Brabandt <cb@256bit.org>
2025-12-12 08:49:19 +08:00
zeertzjq
d1604e0f38 vim-patch:9.1.1969: Wrong cursor position after formatting with long 'formatprg' (#36918)
Problem:  Wrong cursor position after formatting with long 'formatprg'.
Solution: Don't show hit-enter prompt when there are stuffed characters.

Previously a stuffed character at the hit-enter prompt will dismiss the
prompt immediately and be put in the typeahead buffer, which leads to
incorrect behavior as the typeahead buffer is processed after the stuff
buffers. Using vungetc() when KeyStuffed is TRUE can fix this problem,
but since the hit-enter prompt isn't visible anyway (and is likely not
desired here), just skip the prompt instead, which also avoids a wait
when using "wait" instead of "hit-enter" in 'messagesopt'.

fixes:  vim/vim#18905
closes: vim/vim#18906

50325c3d59
(cherry picked from commit 18642a63be)
2025-12-12 00:45:44 +00:00
skewb1k
83c589d95f fix(lua): relax vim.wait() timeout validation (#36907)
fix(lua): relax `vim.wait()` timeout validation #36900

Problem:
After bc0635a9fc `vim.wait()` rejects floats
and NaN values.

Solution:
Restore the prior behavior, while still supporting `math.huge`. Update
tests to cover float case.

(cherry picked from commit b87bdef2a8)
2025-12-10 11:09:24 -05:00
zeertzjq
7e99466a89 fix(eval): 0 should mean current tabpage in gettabvar() (#36891)
This matches the gettabvar() behavior change in Vim 8.1.1218.

(cherry picked from commit df9e4a037a)
2025-12-10 01:42:58 +00:00
skewb1k
9acbf5102f fix(lua): vim.wait(math.huge) fails #36885
Problem:
`nlua_wait()` uses `luaL_checkinteger()` which doesn't support
`math.huge` since it's double type. On PUC Lua this fails with
'number has no integer representation' error and on LuaJIT this
overflows int.

Solution:
Use `luaL_checknumber()` and handle `math.huge`.

(cherry picked from commit bc0635a9fc)
2025-12-09 23:20:22 +00:00
zeertzjq
0706c55ab1 vim-patch:partial:9.1.1955: sort() does not handle large numbers correctly (#36840)
Problem:  sort() does not handle large numbers correctly
          (Igbanam Ogbuluijah)
Solution: Don't truncate the return value of tv_get_number_chk()
          (Yegappan Lakshmanan)

closes: vim/vim#18868

04794efe12

Use a Lua test for now, as the Vimscript test uses tuples.

Co-authored-by: Yegappan Lakshmanan <yegappan@yahoo.com>
(cherry picked from commit 5370b7a2e0)
2025-12-06 14:30:09 +00:00
CompileAndConquer
fa24e045e9 fix(buffer): defer w_buffer clearing to prevent dict watcher crash #36748
(cherry picked from commit f9ef1a4cab)
2025-12-01 02:35:30 +00:00
zeertzjq
9fb49aacde fix(buffer): don't allow changedtick watcher to delete buffer (#36764)
(cherry picked from commit 14d65dae91)
2025-12-01 01:47:44 +00:00
Justin M. Keyes
1f93acc293 backport: build(windows): vendor xxd.c (#36755)
backport https://github.com/neovim/neovim/pull/36746

Problem:
Currently we fetch a prebuilt xxd.exe from neovim/deps for Windows,
which is not ideal in terms of obviousness, misses updates, and is
clumsy to update.

Solution:
Similar to tee.c (#36363), vendor xxd.c from Vim and build it as part
of the Neovim build process. This makes the source obvious, enables
analyzer checks, and simplifies updates.

Fixes #36664

Co-authored-by: benarcher2691 <ben.archer2691@gmail.com>
2025-11-30 05:33:55 +00:00
Kent Sibilev
656ff4c438 fix(events): crash on WinScrolled #35995
Problem: apply_autocmds function can free both buf_T and win_T pointers

Solution: instead retain winids for WinResized and WinScrolled
autocmds and use curbuf pointer, which is consistent with other uses
of apply_autocmds function

(cherry picked from commit 0a0c349b6f)
2025-11-26 15:17:02 +00:00
Riccardo Mazzarini
da825e5541 fix(api): on_bytes gets stale data on :substitute #36487
Problem: `extmark_splice()` was being called before `ml_replace()`,
which caused the on_bytes callback to be invoked with the old buffer
text instead of the new text.

Solution: store metadata for each match in a growing array, call
`ml_replace()` once to update the buffer, then call `extmark_splice()`
once per match.

Closes https://github.com/neovim/neovim/issues/36370.

(cherry picked from commit 7da4d6abe2)
2025-11-21 06:15:38 +00:00
Lewis Russell
53090ab6a8 fix(statusline): scope truncation bookkeeping
Limit the default truncation item to the current recursion range so
nested `nvim_eval_statusline()` calls don't reuse stale `stl_items`
pointers. Add a functional regression that evaluates a Lua statusline
helper which forces truncation to ensure the nested scenario stays
stable.

AI-Assist: OpenAI ChatGPT

Fixes #36616

(cherry picked from commit e9b6474ae7)
2025-11-20 12:10:46 +00:00
neovim-backports[bot]
6a507bad18 fix(vim.fs): abspath(".") returns "/…/." (#36584)
fix(vim.fs): abspath(".") returns "/…/." #36583

(cherry picked from commit 1f9d9cb2e5)

Co-authored-by: Justin M. Keyes <justinkz@gmail.com>
2025-11-17 08:49:19 -08:00
Cameron Ring
d974c684da fix(vim.fs): root() should always return absolute path #36466
(cherry picked from commit f11f8546e7)
2025-11-17 06:09:23 +00:00
zeertzjq
a6bc5780ac test(api/server_requests_spec): fix flaky test (again) (#36570)
Use a fast API, as a deferred API request may be aborted by EOF.

(cherry picked from commit c924d68021)
2025-11-16 10:38:51 +00:00
zeertzjq
88ff561dcc vim-patch:9.1.1893: ICCF charity will dissolve (#36427)
Problem:  ICCF charity will dissolve
Solution: Update references to Kuwasha

Since the ICCF[1] will be dissolved and handing over to the Kuwasha charity
to continue supporting the Kibaale Children Center in Uganda, update the
uganda.txt help file.

[1]: https://groups.google.com/g/vim_announce/c/pUNbNXBLbKw/m/-zFUd4JjAQAJ

fixes: vim/vim#18584
closes: vim/vim#18667

0405665638

Co-authored-by: Christian Brabandt <cb@256bit.org>
2025-11-02 08:30:42 +08:00
varsidry
7790dca2eb vim-patch:9.1.1891: g<End> does not move to last non-blank in visual mode (#36354)
Problem:  In visual mode, g<End> does not move to the last non-blank
          character when the end of a line is on the same line as the
          cursor (after v9.0.1753)
Solution: Move the cursor back by one position if it lands after the
          line (varsidry)

fixes: vim/vim#18657
closes: vim/vim#18658

adc85151f3
(cherry picked from commit b92b95e2c2)
2025-11-01 02:08:42 +00:00
zeertzjq
d399ed310e fix(socket): avoid stack-use-after-return after timeout (#36405)
Problem:
In socket_connect(), if connecting to the given TCP address times out,
libuv is still trying to connect to the address, and connect_cb may be
called when running the libuv event loop after the `status` variable
referenced by `req.data` goes out of scope.

Solution:
Close the uv_tcp_t handle and wait for connect_cb to be called before
retrying or failing in socket_connect(). This also avoid leaking libuv
handles.

The tests added here only check that the non-timeout case still works,
as checking the timeout case is very hard without modifications to the
code. Removing the first LOOP_PROCESS_EVENT_UNTIL() in socket_connect()
(the one with the timeout) is a way to check that manually.

Also add a comment about the cause of the ASAN error in #34586.
2025-11-01 08:25:02 +08:00
zeertzjq
b74f74ba20 test(api/server_requests_spec): fix flaky test (#36410)
Wait for the notification to be processed.

(cherry picked from commit 2b83237b0f)
2025-10-31 14:45:36 +00:00
zeertzjq
66b8018b06 fix(channel): closing socket with pending writes leaks memory (#36400)
Problem:  Closing socket with pending writes leaks memory.
Analysis: When calling rstream_may_close() on an RStream with pending
          writes, it waits for write_cb() to call stream_close_handle(),
          which closes it as if it's a WStream and doesn't free the
          RStream's buffer.
Solution: Ensure that an RStream's buffer is freed when it's closed.
2025-10-31 01:49:21 +00:00
zeertzjq
a6d8f40b64 fix(terminal): keep last cursor if it's on the last row 2025-10-29 13:08:22 +08:00
zeertzjq
a2d4a0fda9 vim-patch:9.1.1885: Wrong restored cursor pos when re-entering buffer after changes
Problem:  Wrong restored cursor position when re-entering a buffer
          previously viewed in a window after making changes to the same
          buffer in another window.
Solution: Adjust per-window "last cursor" positions on buffer changes.
          (zeertzjq)

closes: vim/vim#18655

b2e6b328da
2025-10-29 13:08:22 +08:00
Sean Dewar
e4db5edb8a fix(terminal): don't trigger TextChangedT for unrelated redraws
Problem: TextChangedT fires depending on whether Nvim needs to update_screen
while in terminal mode. This makes little sense as redraws can be completely
unrelated to the terminal. Also, TextChanged could be fired from changes in
terminal mode after returning to normal mode.

Solution: trigger it when b:changedtick changes, like other such events. Happens
when invalid cells are refreshed, though is no longer affected by cursor
changes. Don't fire TextChanged from changes in terminal mode after leaving.

Unlike the other TextChanged* events, I've elected to not have it be influenced
by typeahead. Plus, unlike when leaving insert mode when no TextChangedI events
are defined, I don't trigger TextChanged when returning to normal mode from
changes in terminal mode (is that a Vim bug?)

Curiously, Vim's TextChangedT is different; it's tied to its terminal cursor
redraws, which triggers pretty eagerly (but is unaffected by unrelated redraws)
- usually *twice* when data is sent to the terminal (regardless of whether it
causes any visible changes, like incomplete escape codes; wasn't true for Nvim).

Not clear to me how this event was actually intended to work, but this seems to
make the most sense to me.
2025-10-29 13:08:22 +08:00
Sean Dewar
5ee9e3f258 fix(terminal): possibly wrong wrow/wcol in active terminal
Problem: w_wrow/col calculation in terminal_check_cursor is wrong when the
terminal is smaller than the window. Common when there's a larger window open
with the same terminal, or just after a resize (as refresh_size is deferred).

Solution: don't calculate it; validate_cursor will correct it later if it's
out-of-date.

Note that the toplines set for the terminal (also before this PR) assume
'nowrap' (which is set by default for terminal windows), and that no weird stuff
like filler lines are around. That means, for example, it's possible for the
cursor to be moved off-screen if there's wrapped lines. If this happens, it's
likely update_topline will move the cursor back on screen via validate_cursor or
similar, but maybe this should be handled more elegantly in the future?
2025-10-29 13:08:22 +08:00
Sean Dewar
46d68e5290 fix(terminal): patch various autocommand-related holes
Problem: autocommands can cause various problems in terminal mode, which can
lead to crashes, for example.

Solution: fix found issues. Move some checks to terminal_check and guard against
autocommands messing with things. Trigger TermEnter/Leave after terminal mode
has changed/restored most state. Wipeout the correct buffer if TermLeave
switches buffers and fix a UAF if it or WinScrolled/Resized frees the terminal
prematurely.

These changes also allow us to remove the buffer restrictions on TextChangedT;
they were inadequate in stopping some issues, and WinScrolled/Resized was
lacking them anyway.
2025-10-29 13:08:22 +08:00
Sean Dewar
2eea65fe68 fix(terminal): update winopts and focus when switching terminals
Problem: window options and terminal focus notifications not updated when
switching terminals without leaving terminal mode.

Solution: update them.
2025-10-29 13:08:22 +08:00
Sean Dewar
934d28558d fix(terminal): check size when creating new tabpage
Problem: when creating a new tabpage with a terminal window, terminal size is
not updated if there is no statusline.

Solution: do not rely on last_status to implicitly call terminal_check_size as a
side effect of making room for a statusline; call it directly.
2025-10-29 13:08:22 +08:00
Sean Dewar
f3f6705075 fix(terminal): avoid events messing up topline of focused terminal
Problem: topline of a focused terminal window may not tail to terminal output if
events scroll the window.

Solution: set the topline in terminal_check_cursor.
2025-10-29 13:08:22 +08:00
Sean Dewar
7f5427b857 fix(terminal): add various missing redraws
Problem: missing redraws when restoring saved cursorline/column, plus missing
statusline and mode redraws when not updating the screen in terminal mode.

Solution: schedule the redraws in a similar manner to other modes and remove
some now unnecessary redrawing logic. Redraw if cursorline-related options
change from entering terminal mode. This fixes test failures in later commits.

WTF: TextChangedT triggers based on must_redraw, which is... fun...? Try to
preserve its behaviour as much as we can for now.
2025-10-29 13:08:22 +08:00
Sean Dewar
8c5bc4920a fix(terminal): avoid tailed cursor in focused terminal in events
Problem: in terminal mode, adjust_topline moves curwin's cursor to the last row
so set_topline tails the non-scrollback area. This may result in the observed
cursor position remaining tailed in events within the focused terminal, rather
than reflecting the actual cursor position.

Solution: use the focused terminal's actual cursor position immediately, rather
than relying on the next terminal_check_cursor call in terminal_check to set it.

Note: Maybe also possible for terminal mode cursor position to be stale
(reporting the normal mode position) when switching buffers in events to another
terminal until the next terminal_check call? (or until refresh_terminal is
called for it) Maybe not worth fixing that, though.
2025-10-29 13:08:22 +08:00
zeertzjq
98dfd25c8b test(ex_terminal_spec): fix flakiness (#36347)
(cherry picked from commit db35dd6734)
2025-10-27 03:30:22 +00:00
zeertzjq
8928ede8af vim-patch:9.1.1870: :Tutor may not work as expected (#36343)
Problem:  :Tutor may not work as expected
Solution: set buftype=nowrite instead of nofile
          (Phạm Bình An)

closes: vim/vim#18613

9978bb77c6

Co-authored-by: Phạm Bình An <phambinhanctb2004@gmail.com>
(cherry picked from commit fb6fd17f26)
2025-10-27 01:52:29 +00:00
zeertzjq
1b27d8f428 vim-patch:9.1.1871: Wrong 'showcmd' in the cmdwin (#36320)
Problem:  Wrong 'showcmd' in the command-line window.
Solution: Clear 'showcmd' when entering cmdwin (zeertzjq).

related: neovim/neovim#36271
closes: vim/vim#18616

826326f13b
(cherry picked from commit 5db3544991)
2025-10-25 14:45:41 +00:00
zeertzjq
d78d5cf1aa fix(terminal): adjust marks when deleting scrollback lines (#36294)
This also fixes inconsistent scrolling behavior on terminal output when
cursor is in the middle of the buffer and the scrollback is full.
2025-10-25 07:09:10 +08:00
xvzc
0e1c83fae2 fix(filetype): handle invalid bufnr in _getlines(), _getline() #36272
**Problem:**
`vim.filetype.match({ filename = 'a.sh' })` returns `nil` because
an invalid buffer ID is passed to `vim.api.nvim_buf_get_lines()`.
For filetypes like `csh`, `txt`, or any other extensions that call
`_getlines()` or `_getline()` to detect their filetypes, the same
issue occurs.

When only the `filename` argument is passed, an error is raised
inside a `pcall()` that wraps the filetype detection function,
causing it to return no value without showing any error message.

**Solution:**
Validate the `bufnr` value in `_getlines()` and `_getline()`.

(cherry picked from commit 095b9f98f3)
2025-10-24 01:14:30 +00:00
zeertzjq
169dc60a44 fix(terminal): wrong row in TermRequest with full scrollback (#36298)
Problem:  Wrong row in TermRequest with full scrollback.
Solution: Subtract by the number of lines deleted from scrollback.
(cherry picked from commit 67832710a5)
2025-10-23 22:33:16 +00:00
Jan Edmund Lazo
b0ed4a3cb8 vim-patch:8.2.3795: too many #ifdefs
Problem:    Too many #ifdefs.
Solution:   Graduate the jumplist feature.

739f13a55b

Co-authored-by: Bram Moolenaar <Bram@vim.org>
2025-10-23 17:08:10 +08:00
zeertzjq
4cc060bf44 fix(statusline): redraw if Visual selection other end changes (#36281)
(cherry picked from commit af0f7b59b1)
2025-10-23 04:22:47 +00:00
Matthieu Coudron
f9cad88d5a feat(vimscript): log function name in "fast" message #32616
(cherry picked from commit e42050f4ae)
2025-10-21 15:17:01 +00:00