blob: ff9b63ba3ac2a29ffe20cb22aed72c91e43a43e4 [file] [log] [blame]
Christian Brabandte1dc9a62023-09-02 14:40:13 +02001" Some tests, that used to crash Vim
Christian Brabandteb380b92025-07-07 20:53:55 +02002source util/screendump.vim
Christian Brabandte1dc9a62023-09-02 14:40:13 +02003
4CheckScreendump
5
Yee Cheng Chine70587d2025-02-13 20:55:45 +01006" Run the command in terminal and wait for it to complete via notification
7func s:RunCommandAndWait(buf, cmd)
8 call term_sendkeys(a:buf, a:cmd .. "; printf '" .. TermNotifyParentCmd(v:false) .. "'\<cr>")
9 call WaitForChildNotification()
10endfunc
11
Christian Brabandte1dc9a62023-09-02 14:40:13 +020012func Test_crash1()
Christian Brabandtd2a08ba2023-09-05 07:45:04 +020013 CheckNotBSD
Philip H1690ec62023-09-06 20:20:07 +020014 CheckExecutable dash
Christian Brabandtd2a08ba2023-09-05 07:45:04 +020015
Christian Brabandte1dc9a62023-09-02 14:40:13 +020016 " The following used to crash Vim
Christian Brabandtdb510ca2023-09-03 09:23:12 +020017 let opts = #{cmd: 'sh'}
Christian Brabandtdb510ca2023-09-03 09:23:12 +020018 let vim = GetVimProg()
19
Christian Brabandtfc682992023-09-03 20:20:52 +020020 let buf = RunVimInTerminal('sh', opts)
Christian Brabandtdb510ca2023-09-03 09:23:12 +020021
22 let file = 'crash/poc_huaf1'
23 let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'"
24 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +010025 call s:RunCommandAndWait(buf, args ..
26 \ ' && echo "crash 1: [OK]" > X_crash1_result.txt')
Christian Brabandtdb510ca2023-09-03 09:23:12 +020027
28 let file = 'crash/poc_huaf2'
29 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +010030 call s:RunCommandAndWait(buf, args ..
31 \ ' && echo "crash 2: [OK]" >> X_crash1_result.txt')
Christian Brabandtdb510ca2023-09-03 09:23:12 +020032
33 let file = 'crash/poc_huaf3'
34 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +010035 call s:RunCommandAndWait(buf, args ..
36 \ ' && echo "crash 3: [OK]" >> X_crash1_result.txt')
Christian Brabandtdb510ca2023-09-03 09:23:12 +020037
Christian Brabandtfc682992023-09-03 20:20:52 +020038 let file = 'crash/bt_quickfix_poc'
39 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +010040 call s:RunCommandAndWait(buf, args ..
41 \ ' && echo "crash 4: [OK]" >> X_crash1_result.txt')
Christian Brabandtfc682992023-09-03 20:20:52 +020042 " clean up
43 call delete('Xerr')
Christian Brabandtdb510ca2023-09-03 09:23:12 +020044
Christian Brabandtee9166e2023-09-03 21:24:33 +020045 let file = 'crash/poc_tagfunc.vim'
46 let args = printf(cmn_args, vim, file)
Christian Brabandtf6d28fe2023-09-05 20:18:06 +020047 " using || because this poc causes vim to exit with exitstatus != 0
Yee Cheng Chine70587d2025-02-13 20:55:45 +010048 call s:RunCommandAndWait(buf, args ..
49 \ ' || echo "crash 5: [OK]" >> X_crash1_result.txt')
Christian Brabandtee9166e2023-09-03 21:24:33 +020050
Christian Brabandtee9166e2023-09-03 21:24:33 +020051
Christian Brabandt6e60cf42023-09-03 21:43:46 +020052 let file = 'crash/bt_quickfix1_poc'
53 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +010054 call s:RunCommandAndWait(buf, args ..
55 \ ' && echo "crash 6: [OK]" >> X_crash1_result.txt')
Christian Brabandt6e60cf42023-09-03 21:43:46 +020056 " clean up
57 call delete('X')
Christian Brabandt6e60cf42023-09-03 21:43:46 +020058
Christian Brabandtf6d28fe2023-09-05 20:18:06 +020059 let file = 'crash/vim_regsub_both_poc'
60 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +010061 call s:RunCommandAndWait(buf, args ..
62 \ ' && echo "crash 7: [OK]" >> X_crash1_result.txt')
Christian Brabandtf6d28fe2023-09-05 20:18:06 +020063
Christian Brabandt3bd7fa12023-10-02 20:59:08 +020064 let file = 'crash/vim_msg_trunc_poc'
65 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +010066 call s:RunCommandAndWait(buf, args ..
67 \ ' || echo "crash 8: [OK]" >> X_crash1_result.txt')
Christian Brabandt3bd7fa12023-10-02 20:59:08 +020068
Christian Brabandt20d161a2023-10-05 22:08:30 +020069 let file = 'crash/crash_scrollbar'
70 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +010071 call s:RunCommandAndWait(buf, args ..
72 \ ' && echo "crash 9: [OK]" >> X_crash1_result.txt')
Christian Brabandt20d161a2023-10-05 22:08:30 +020073
Christian Brabandt41e6f7d2023-10-11 21:08:13 +020074 let file = 'crash/editing_arg_idx_POC_1'
75 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +010076 call s:RunCommandAndWait(buf, args ..
77 \ ' || echo "crash 10: [OK]" >> X_crash1_result.txt')
Christian Brabandt41e6f7d2023-10-11 21:08:13 +020078 call delete('Xerr')
79 call delete('@')
80
Christian Brabandtdb510ca2023-09-03 09:23:12 +020081 " clean up
Christian Brabandte1dc9a62023-09-02 14:40:13 +020082 exe buf .. "bw!"
83
Christian Brabandtdb510ca2023-09-03 09:23:12 +020084 sp X_crash1_result.txt
Christian Brabandtfc682992023-09-03 20:20:52 +020085
86 let expected = [
87 \ 'crash 1: [OK]',
88 \ 'crash 2: [OK]',
89 \ 'crash 3: [OK]',
90 \ 'crash 4: [OK]',
Christian Brabandtee9166e2023-09-03 21:24:33 +020091 \ 'crash 5: [OK]',
Christian Brabandt6e60cf42023-09-03 21:43:46 +020092 \ 'crash 6: [OK]',
Christian Brabandtf6d28fe2023-09-05 20:18:06 +020093 \ 'crash 7: [OK]',
Christian Brabandt3bd7fa12023-10-02 20:59:08 +020094 \ 'crash 8: [OK]',
Christian Brabandt20d161a2023-10-05 22:08:30 +020095 \ 'crash 9: [OK]',
Christian Brabandt41e6f7d2023-10-11 21:08:13 +020096 \ 'crash 10: [OK]',
Christian Brabandtfc682992023-09-03 20:20:52 +020097 \ ]
98
99 call assert_equal(expected, getline(1, '$'))
Christian Brabandtdb510ca2023-09-03 09:23:12 +0200100 bw!
Christian Brabandte1dc9a62023-09-02 14:40:13 +0200101
Christian Brabandtdb510ca2023-09-03 09:23:12 +0200102 call delete('X_crash1_result.txt')
Christian Brabandte1dc9a62023-09-02 14:40:13 +0200103endfunc
104
Christian Brabandt25aabc22023-11-14 19:31:34 +0100105func Test_crash1_2()
106 CheckNotBSD
107 CheckExecutable dash
108
109 " The following used to crash Vim
110 let opts = #{cmd: 'sh'}
111 let vim = GetVimProg()
Christian Brabandtabfa13e2023-11-30 11:32:18 +0100112 let result = 'X_crash1_2_result.txt'
Christian Brabandt25aabc22023-11-14 19:31:34 +0100113
114 let buf = RunVimInTerminal('sh', opts)
115
116 let file = 'crash/poc1'
117 let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'"
118 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100119 call s:RunCommandAndWait(buf, args ..
120 \ ' && echo "crash 1: [OK]" > '.. result)
Christian Brabandt25aabc22023-11-14 19:31:34 +0100121
Christian Brabandteec0c2b2023-11-28 22:03:48 +0100122 let file = 'crash/poc_win_enter_ext'
123 let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'"
124 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100125 call s:RunCommandAndWait(buf, args ..
126 \ ' && echo "crash 2: [OK]" >> '.. result)
Christian Brabandteec0c2b2023-11-28 22:03:48 +0100127
Christian Brabandt0fb375a2023-11-29 10:23:39 +0100128 let file = 'crash/poc_suggest_trie_walk'
129 let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'"
130 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100131 call s:RunCommandAndWait(buf, args ..
132 \ ' && echo "crash 3: [OK]" >> '.. result)
Christian Brabandt0fb375a2023-11-29 10:23:39 +0100133
Christian Brabandtb39b2402023-11-29 11:34:05 +0100134 let file = 'crash/poc_did_set_langmap'
135 let cmn_args = "%s -u NONE -i NONE -n -X -m -n -e -s -S %s -c ':qa!'"
136 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100137 call s:RunCommandAndWait(buf, args ..
138 \ ' ; echo "crash 4: [OK]" >> '.. result)
Christian Brabandtb39b2402023-11-29 11:34:05 +0100139
Christian Brabandtcacb6692024-08-22 21:40:14 +0200140 let file = 'crash/reverse_text_overflow'
141 let cmn_args = "%s -u NONE -i NONE -n -X -m -n -e -s -S %s -c ':qa!'"
142 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100143 call s:RunCommandAndWait(buf, args ..
144 \ ' ; echo "crash 5: [OK]" >> '.. result)
Christian Brabandtcacb6692024-08-22 21:40:14 +0200145
Christian Brabandt25aabc22023-11-14 19:31:34 +0100146 " clean up
147 exe buf .. "bw!"
Christian Brabandt25aabc22023-11-14 19:31:34 +0100148 exe "sp " .. result
Christian Brabandt25aabc22023-11-14 19:31:34 +0100149 let expected = [
150 \ 'crash 1: [OK]',
Christian Brabandteec0c2b2023-11-28 22:03:48 +0100151 \ 'crash 2: [OK]',
Christian Brabandt0fb375a2023-11-29 10:23:39 +0100152 \ 'crash 3: [OK]',
Christian Brabandtb39b2402023-11-29 11:34:05 +0100153 \ 'crash 4: [OK]',
Christian Brabandtcacb6692024-08-22 21:40:14 +0200154 \ 'crash 5: [OK]',
Christian Brabandt25aabc22023-11-14 19:31:34 +0100155 \ ]
156
157 call assert_equal(expected, getline(1, '$'))
158 bw!
Christian Brabandt25aabc22023-11-14 19:31:34 +0100159 call delete(result)
160endfunc
161
Christian Brabandt5dd41d42023-12-04 22:52:23 +0100162" This test just runs various scripts, that caused issues before.
163" We are not really asserting anything here, it's just important
164" that ASAN does not detect any issues.
165func Test_crash1_3()
166 let vim = GetVimProg()
167 let buf = RunVimInTerminal('sh', #{cmd: 'sh'})
168
169 let file = 'crash/poc_ex_substitute'
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100170 let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'"
Christian Brabandt5dd41d42023-12-04 22:52:23 +0100171 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100172 call s:RunCommandAndWait(buf, args)
Christian Brabandt5dd41d42023-12-04 22:52:23 +0100173
174 let file = 'crash/poc_uaf_exec_instructions'
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100175 let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'"
Christian Brabandt5dd41d42023-12-04 22:52:23 +0100176 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100177 call s:RunCommandAndWait(buf, args)
Christian Brabandt5dd41d42023-12-04 22:52:23 +0100178
Christian Brabandt0f287912023-12-11 17:53:25 +0100179 let file = 'crash/poc_uaf_check_argument_types'
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100180 let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'"
Christian Brabandt0f287912023-12-11 17:53:25 +0100181 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100182 call s:RunCommandAndWait(buf, args)
Christian Brabandt0f287912023-12-11 17:53:25 +0100183
Christian Brabandt8a0bbe72024-08-01 20:16:51 +0200184 let file = 'crash/double_free'
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100185 let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'"
Christian Brabandt8a0bbe72024-08-01 20:16:51 +0200186 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100187 call s:RunCommandAndWait(buf, args)
Christian Brabandt8a0bbe72024-08-01 20:16:51 +0200188
Christian Brabandtb29f4ab2024-08-01 22:10:28 +0200189 let file = 'crash/dialog_changed_uaf'
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100190 let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'"
Christian Brabandtb29f4ab2024-08-01 22:10:28 +0200191 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100192 call s:RunCommandAndWait(buf, args)
Christian Brabandtb29f4ab2024-08-01 22:10:28 +0200193
Christian Brabandtfb3f9692024-08-11 20:09:17 +0200194 let file = 'crash/nullpointer'
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100195 let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'"
Christian Brabandtfb3f9692024-08-11 20:09:17 +0200196 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100197 call s:RunCommandAndWait(buf, args)
Christian Brabandtfb3f9692024-08-11 20:09:17 +0200198
Christian Brabandt322ba912024-08-25 21:33:03 +0200199 let file = 'crash/heap_overflow3'
200 let cmn_args = "%s -u NONE -i NONE -n -X -m -n -e -s -S %s -c ':qa!'"
201 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100202 call s:RunCommandAndWait(buf, args)
Christian Brabandt322ba912024-08-25 21:33:03 +0200203
Christian Brabandtc9bfed22024-08-29 22:12:05 +0200204 let file = 'crash/heap_overflow_glob2regpat'
205 let cmn_args = "%s -u NONE -i NONE -n -X -m -n -e -s -S %s -c ':qa!'"
206 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100207 call s:RunCommandAndWait(buf, args)
Christian Brabandt1c815b52024-08-28 22:08:35 +0200208
Christian Brabandtc3a02d72024-08-28 23:17:52 +0200209 let file = 'crash/nullptr_regexp_nfa'
210 let cmn_args = "%s -u NONE -i NONE -n -X -m -n -e -s -S %s -c ':qa!'"
211 let args = printf(cmn_args, vim, file)
Yee Cheng Chine70587d2025-02-13 20:55:45 +0100212 call s:RunCommandAndWait(buf, args)
Christian Brabandt9d1bed52025-01-20 22:55:57 +0100213
Christian Brabandt5dd41d42023-12-04 22:52:23 +0100214 " clean up
215 exe buf .. "bw!"
216 bw!
217endfunc
218
Christian Brabandtced2c732023-09-02 21:15:52 +0200219func Test_crash2()
Drew Vogelea67ba72025-05-07 22:05:17 +0200220 CheckScreendump
Christian Brabandtced2c732023-09-02 21:15:52 +0200221 " The following used to crash Vim
222 let opts = #{wait_for_ruler: 0, rows: 20}
223 let args = ' -u NONE -i NONE -n -e -s -S '
224 let buf = RunVimInTerminal(args .. ' crash/vim_regsub_both', opts)
225 call VerifyScreenDump(buf, 'Test_crash_01', {})
226 exe buf .. "bw!"
227endfunc
228
zeertzjqd56c4512024-08-26 18:45:37 +0200229func TearDown()
230 " That file is created at Test_crash1_3() by dialog_changed_uaf
231 " but cleaning up in that test doesn't remove it. Let's try again at
Christian Brabandtcd831732024-08-24 17:34:19 +0200232 " the end of this test script
233 call delete('Untitled')
234endfunc
235
Christian Brabandte1dc9a62023-09-02 14:40:13 +0200236" vim: shiftwidth=2 sts=2 expandtab