Problem: MS-Window: stripping all CSI sequences
(Ke Mao, after v9.2.0184)
Solution: Restore vtp_printf() to pass-through DECSUSR codes
(Yasuhiro Matsumoto).
Patch 9.2.0184 discards all CSI sequences in mch_write() when VTP is
active to prevent unwanted DECRQM responses. However, this also
removed the existing DECSCUSR pass-through, breaking cursor shape
changes (t_SI/t_SR/t_EI) on Windows Terminal.
Restore vtp_printf() pass-through for DECSCUSR (final byte 'q') while
continuing to discard other CSI sequences.
related: #19694
related: #11532
fixes: #19750
closes: #19755
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: xxd: Cannot NUL terminate the C include file style
Solution: Add option -t to end output with terminating null
(Lukáš Jiřiště).
fixes: #14409closes: #19745
Signed-off-by: Lukáš Jiřiště <kyci@ljiriste.work>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: The glob() function on Unix-like systems does not escape
newline characters when expanding wildcards. A maliciously
crafted string containing '\n' can be used as a command
separator to execute arbitrary shell commands via
mch_expand_wildcards(). This depends on the user's 'shell'
setting.
Solution: Add the newline character ('\n') to the SHELL_SPECIAL
definition to ensure it is properly escaped before being
passed to the shell (pyllyukko).
closes: #19746
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-w5jw-f54h-x46c
Signed-off-by: pyllyukko <pyllyukko@maimed.org>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: term: DECRQM codes are sent too early, the resulting DECRPM
responses can arrive after Vim has already exited, leaking
into the shell's input buffer (Christian Brabandt).
Solution: Only send DECRQM codes once termcap_active is set
(Foxe Chen).
related: #19660
fixes: #19660#issuecomment-4085448070
closes: #19748
Signed-off-by: Foxe Chen <chen.foxe@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: tests: test_startup.vim fails, because the command line is
getting too long so that the shell prompt line get shifted by one
additional screen line down (after v9.2.0194).
Solution: Partly revert Patch v9.2.0194 and do not set termresize and
termsync options.
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: cscope: can escape from restricted mode (pyllyukko)
Solution: Disallow :cscope in restricted mode (like :grep),
add a tests for restricted mode using :grep and :cscope
closes: #19731
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: When 'showtabpanel' is set before any window exists (e.g. via
--cmd) and multiple tab pages are opened with -p, the tabpanel
appears when the second tab page is created. At that point
shell_new_columns() only updates the current (new) tab page's
frame width; existing tab pages retain the wrong width.
Solution: After calling shell_new_columns() in win_new_tabpage(), iterate
all other tab pages and update their frame widths with
frame_new_width() (Hirohito Higashi).
related: #19730
closes: #19734
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Add a minimal ftplugin `runtime/ftplugin/yara.vim` that sets:
- `commentstring` for YARA line comments (`//`)
- `comments` for YARA block comment (`/* */`)
- `formatoptions` to wrap comment lines and continue comment after newlines
This was heavily inspired from `runtime/ftplugin/c.vim`
closes: #19736
Signed-off-by: Thomas Dupuy <thom4s.d@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: textprop: negative IDs and can cause a crash without "text"
(Paul Ollis)
Solution: Strictly reserve negative IDs for virtual text, ignore "id"
when "text" is provided in prop_add() (Hirohito Higashi).
When prop_add() was called with a negative id and no "text", the
property was stored with a negative tp_id. A subsequent call to
prop_list() or screen redraw would then treat it as a virtual text
property and dereference b_textprop_text.ga_data, which is NULL when
no virtual text properties exist.
Negative ids are reserved for virtual text properties, so always
reject them with E1293 regardless of whether virtual text properties
exist. Also, when "text" is specified any user-provided id is now
silently ignored and an internal negative id is assigned.
Remove the now-unnecessary did_use_negative_pop_id flag and E1339.
Update E1293's message and the documentation accordingly.
related: #19684
closes: #19741
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: test_codestyle.vim takes too much time and takes more than
90s, this contributes to the overall time for all runners and
Solution: Create a dedicated 'make codestyle' target in the testdir
Makefiles. Remove test_codestyle from the main test list.
Update GitHub CI to run this check as a separate step
in the 'normal' features build.
Increase CI timeout to 45 minutes.
fixes: #19740
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: tests: test_startup.vim leaves temp.txt around
Solution: Disable termresize and termsync explicitly to stop outputting
DEC mode chars, delete all chars before the rm command
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: using copy_option_part() can be improved
Solution: Refactor and use the return value of copy_option_part() to
avoid strlen() calls (John Marriott).
In addition, this commit includes the following changes:
memline.c:
- In recover_names():
- Replace calls to vim_strsave() with vim_strnsave() for the literal
strings
- Use a string_T to store local variable dir_name.
bufwrite.c:
- In buf_write()
- move variable wp to where it is used.
help.c:
- In fix_help_buffer():
- replace call to add_pathsep() with after_pathsep()
optionstr.c:
- In export_myvimdir():
- use a string_T to store local variable buf
- replace call to add_pathsep() with after_pathsep()
scriptfile.c:
- In do_in_path():
- use a string_T to store local variable buf
- measure the lengths of prefix and name once before the while loop
- replace call to add_pathsep() with after_pathsep()
- move some variables closer to where they are used
spellfile.c:
- In init_spellfile():
- use a string_T to store local variable buf
closes: #19725
Signed-off-by: John Marriott <basilisk@internode.on.net>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: When "k" is excluded from cpoptions, vim should be able to
recognize raw key codes in mappings and replace them with
builtin codes (e.g. ^[OA is replaced with <Up>) so that
changing the builtin code also changes the mapping to match.
Currently, this only works properly if the builtin code does
not contain modifiers (e.g. @;*).
Solution: Teach find_term_bykeys how to recognize keys with modifiers
(AstroSnail).
fixes: #19182closes: #19643
Signed-off-by: AstroSnail <astrosnail@protonmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: The "android" and "termux" feature flags have been shipped in
Termux's downstream vim / vim-gtk package for 5+ years but were
never properly documented in the downstream patch.
Solution: Upstream the "android" and "termux" feature flags into Vim as
decoupled feature flags, this enables the "android" feature in
particular to be available independently of the "termux"
feature for builds of Vim against the Android NDK, but not
including the Termux NDK patchset.
closes: #19623
Co-authored-by: Lethal Lisa <43791059+lethal-lisa@users.noreply.github.com>
Co-authored-by: shadmansaleh <13149513+shadmansaleh@users.noreply.github.com>
Signed-off-by: TomIO <tom@termux.dev>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: When 'laststatus' changes, the status line can become
misaligned.
Solution: Update last_status_rec() to calculate the maximum status line
height required across all windows in a vertical row.
closes: #19688
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: When using transparent popups in the Win32 console, redrawing
background windows causes flickering. This happens because
the background is drawn opaquely before the popup blends
and draws on top.
Solution: Implement a Z-index mask to suppress screen_char() output for
cells covered by an opacity popup. Disable the Clear-to-EOL
(T_CE) optimization for lines overlapping these popups to
prevent accidental erasure (Yasuhiro Matsumoto).
closes: #19697
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: MS-Windows: rendering artifacts with DirectX renderer
Solution: Enable ETO_CLIPPED for DirectWrite rendering in
gui_mch_draw_string() to ensure glyphs stay within their
cell boundaries (Yasuhiro Matsumoto).
closes: #19711
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: Using a long generic function name may cause a heap buffer
overflow in common_function().
Solution: Allocate memory for the full name instead of using IObuff
(Kaixuan Li).
closes: #19727
Signed-off-by: Kaixuan Li <kaixuanli0131@gmail.com>
Signed-off-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: When drawing a custom tabline, if topframe->fr_width is
larger than Columns (possible during tab closure with
showtabpanel=1), Vim writes past the end of the
TabPageIdxs[] array.
Solution: Cap the column limit at Columns to ensure TabPageIdxs is
never accessed out-of-bounds (thinca).
closes: #19725
Supported by AI
Signed-off-by: thinca <thinca@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: When 'termguicolors' is used on MS-Windows (VTP mode), sending
CSI query sequences (like DECRQM) causes the console to
generate responses that are misinterpreted as keystrokes.
The leading ESC triggers a beep or 'visualbell' flash.
Solution: In mch_write(), discard CSI sequences when USE_VTP is active
so the console does not process queries and generate unwanted
input responses (Yasuhiro Matsumoto).
related: #11532
closes: #19694
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: gethostbyname() and inet_ntoa() are deprecated and cause
build errors on modern MSVC versions.
Solution: Use getaddrinfo() and inet_ntop() when FEAT_IPV6 and
HAVE_INET_NTOP are defined. Keep the old functions as
fallbacks for legacy platforms (Yasuhiro Matsumoto).
closes: #19719
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: autocmds that switch windows may cause them to remain with
w_locked set, preventing them from being closed longer than
intended.
Solution: Unset w_locked in the window where it was set (Sean Dewar).
closes: #19716
Signed-off-by: Sean Dewar <6256228+seandewar@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: line('w0') moves cursor in terminal-normal mode
(Biebar, after v9.2.0127)
Solution: Check that the terminal is not in terminal-normal-mode
(Ozaki Kiichi).
fixes: #19717closes: #19718
Signed-off-by: Ozaki Kiichi <gclient.gaap@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: possible crash with winminheight=0
(Emilien Breton)
Solution: Use <= instead of < when checking reserved room in
frame_setheight() to correctly handle the zero-height
boundary case (Hirohito Higashi).
In frame_setheight(), when shrinking the current window and the only
other window has 'winfixheight' with 'winminheight'=0, room_reserved
was not cleared because the condition used '<' instead of '<='.
The freed rows were discarded, leaving fr_height sum less than
topframe fr_height. Subsequent resize operations then computed a
wrong room_cmdline that expanded topframe beyond the screen, causing
a crash.
fixes: #19706closes: #19712
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: MS-Windows: Compile warning for converting from size_t to int
breaks the Appveyor CI (after v9.2.0168)
Solution: Explicitly cast to int in convert_string() (ichizok).
closes: #19722
Signed-off-by: ichizok <gclient.gaap@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: Vim sends DEC mode query requests (DECRQM) regardless of the
terminal mode.
Solution: Only send DEC mode requests when cur_tmode is TMODE_RAW, but
e.g not for gui mode (Foxe Chen).
fixes: #19709closes: #19710
Signed-off-by: Foxe Chen <chen.foxe@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: Vim9: Can set environment variables in restricted mode
Solution: Disallow settings variables in exec_instructions() when in
restricted mode (pyllyukko)
related: #13394
closes: #19705
Signed-off-by: pyllyukko <pyllyukko@maimed.org>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: When 'diffopt' does not include "internal", Vim attempts to
execute an external diff command even in restricted mode.
This could be used to bypass restricted mode.
Solution: Call check_restricted() in diff_file() before attempting to
execute an external diff (pyllyukko).
closes: #19696
Signed-off-by: pyllyukko <pyllyukko@maimed.org>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: No tests for what v9.2.0141 and v9.2.0156 fixes
Solution: Add tests for using :perldo and rubeval() in sandbox mode
related: #19664
related: #19653
closes: #19699
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: When using 'diffopt=inline:word', lines were excessively
fragmented with punctuation creating separate highlight
blocks, making it harder to read the diffs.
Solution: Added 'diff_refine_inline_word_highlight()' to merge
adjacent diff blocks that are separated by small gaps of
non-word characters (up to 5 bytes by default) (HarshK97).
When using inline:word diff mode, adjacent changed words separated by
punctuation or whitespace are now merged into a single highlight block
if the gap between them contains fewer than 5 non-word characters.
This creates more readable diffs and closely matches GitHub's own diff
display.
closes: #19098
Signed-off-by: HarshK97 <harshkapse1234@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: tests: Test_balloon_eval_term_visual is flaky
Solution: Use redraw and WaitForAssert() to make it more reliable
Previously, it failed about 1 out of 4 runs for me, now I got it down to
1 out of 10. It's not perfect, but better than before.
closes: #19692
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: Missing semicolon in os_mac_conv.c (after v9.2.0168)
Solution: Add it (Yasuhiro Matsumoto).
The missing semicolon was introduced in patch 9.2.0168
(b00f441e6), which breaks the macOS build.
closes: #19695
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: MS-Windows: GetVersionEx() is deprecated since Windows 8.
Version checks for specific features (like dark mode or title
bar colors) are duplicated across files using multiple boolean flags.
Solution: Use RtlGetVersion() to centralize detection in a single
win_version variable. Use the MAKE_VER() macro to check
against major, minor, and build numbers. Update titlebar
colors and dark theme to use proper version thresholds
(Mao-Yining).
closes: #19673
Signed-off-by: Mao-Yining <mao.yining@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Corrected the translation for 'paste' from '粘帖' to '粘贴'.
In Chinese, the correct term for the computer action "paste" is 粘贴
(zhān tiē). The original translation used 粘帖, which contains a very
common typo. The second character was mistakenly written as 帖 (which
means a note or invitation) instead of the correct character 贴 (which
means to stick or paste).
closes: #19689
Signed-off-by: Murasame <88932464+CuteMurasame@users.noreply.github.com>
Signed-off-by: Mao-Yining <mao.yining@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: channel: some issues in ch_listen()
(char101, after v9.2.0153)
Solution: On MS-Windows, initialize using channel_init_winsock() and use
SO_EXCLUSIVEADDRUSE instead of SO_REUSEADDR, allow to use port
0 to have the OS assign a port (Yasuhiro Matsumoto).
related: #19231
closes: #19690
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
When system() or systemlist() is called without :silent from a
statusline expression, autocommand, or timer callback, the terminal
is temporarily set to cooked mode, which re-enables ECHO on the tty.
If a terminal response (e.g. DECRPM for cursor blink mode) arrives
during this window, the tty driver echoes it to the screen, leaving
stray characters that require CTRL-L to remove.
This behavior was intentionally addressed in patch 7.4.427 by
skipping cooked mode when :silent is prepended. However, the
documentation only mentioned this for system() and did not cover
systemlist() at all. The guidance to use :silent in non-interactive
contexts (statusline, autocommands, timers) was also not explicit.
closes#19691
Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: assertion failure in syn_id2attr()
(@julio-b, after v9.2.0093)
Solution: Set tp_curwin to a valid window in popup_close_tabpage()
and return early in update_winhighlight() if there are
no highlight overrides to update (Foxe Chen).
fixes: #19650closes: #19670
Signed-off-by: Foxe Chen <chen.foxe@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: invalid pointer casting in string_convert() arguments
Solution: Use a temporary local int variable (James McCoy)
string_convert()/string_convert_ext() accept an "int *lenp" parameter,
however a few call sites were taking the address of a possibly larger
type (long, size_t) and casting it as an int * when calling these
functions.
On big-endian platforms, this passes the (likely) zeroed high bytes of
the known length through to string_convert(). This indicates it received
an empty string and returns an allocated empty string rather than
converting the input. This is exhibited by test failures like
From test_blob.vim:
Found errors in Test_blob2str_multi_byte_encodings():
command line..script src/testdir/runtest.vim[636]..function RunTheTest[63]..Test_blob2str_multi_byte_encodings line 2: Expected ['Hello'] but got ['']
command line..script src/testdir/runtest.vim[636]..function RunTheTest[63]..Test_blob2str_multi_byte_encodings line 3: Expected ['Hello'] but got ['']
command line..script srctestdir/runtest.vim[636]..function RunTheTest[63]..Test_blob2str_multi_byte_encodings line 6: Expected ['Hello'] but got ['']
Instead, use a temporary local int variable as the in/out variable for
string_convert() and assign the result back to the larger typed length
variable post-conversion.
closes: #19672
Signed-off-by: James McCoy <jamessan@debian.org>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: setting buftype=terminal may cause a crash
(lacygoill, after v9.2.0127)
Solution: Validate that curwin->w_buffer->b_term is not null
fixes: #19686closes: #19676
Signed-off-by: Christian Brabandt <cb@256bit.org>
Problem: Coverity warning for potential NULL dereference in channel.c
(after v9.2.0153)
Solution: Use empty string in case hostname is NULL.
CID: 1686330
related: #19676
Signed-off-by: Christian Brabandt <cb@256bit.org>
Yasuhiro Matsumoto
Christian Brabandt
Lukáš Jiřiště
Guillaume Barbier
Hirohito Higashi
pyllyukko
Furkan Sahin
Foxe Chen
ichizok
Barrett Ruth
Thomas Dupuy
John Marriott
AstroSnail
TomIO
Kaixuan Li
thinca
elig0n
Sean Dewar
HarshK97
Mao-Yining
Murasame
James McCoy