If the call to `qf_setup_state()` in `qf_init_ext()` fails, control flow jumps to label `qf_init_end` where a call to `qf_update_buffer()` is made with `old_last` as a function call argument. Prior to this patch, `old_last` would not yet have been initialized to its default value of `NULL`, resulting in `qf_update_buffer()` attempting to compare against its uninitialized value (quickfix.c:3882) then later forwarding it to `qf_fill_buffer()` where the address is dereferenced and repeatedly read from/ written to for performing core qflist operations. Depending on what the default value of `old_last` was, the results may range from a best case scenario of neovim terminating with SIGSEGV from an attempt to dereference an invalid pointer (quickfix.c:4056) to memory corruption if it contained some other value that results in `qfp` being initialized from `old_last->qf_next` (after which it is subsequently written to and read from in a fairly arbitrary fashion). Though extremely unlikely, it's possible for there to be security considerations as a user can ensure that the next call to `qf_setup_state()` fails. This patch ensures that `old_last` is NULL-assigned before control flow jumps to `qf_init_end`. Closes #20639. |
||
---|---|---|
.github | ||
ci | ||
cmake | ||
cmake.config | ||
cmake.deps | ||
cmake.packaging | ||
contrib | ||
runtime | ||
scripts | ||
snap | ||
src | ||
test | ||
.cirrus.yml | ||
.clang-format | ||
.clang-tidy | ||
.clangd | ||
.editorconfig | ||
.git-blame-ignore-revs | ||
.gitattributes | ||
.gitignore | ||
.luacheckrc | ||
.luacov | ||
.mailmap | ||
.stylua.toml | ||
.styluaignore | ||
BACKERS.md | ||
BSDmakefile | ||
CMakeLists.txt | ||
CMakePresets.json | ||
codecov.yml | ||
CONTRIBUTING.md | ||
LICENSE.txt | ||
MAINTAIN.md | ||
Makefile | ||
README.md |
Documentation | Chat | Twitter
Neovim is a project that seeks to aggressively refactor Vim in order to:
- Simplify maintenance and encourage contributions
- Split the work between multiple developers
- Enable advanced UIs without modifications to the core
- Maximize extensibility
See the Introduction wiki page and Roadmap for more information.
Features
- Modern GUIs
- API access from any language including C/C++, C#, Clojure, D, Elixir, Go, Haskell, Java, JavaScript/Node.js, Julia, Lisp, Lua, Perl, Python, Racket, Ruby, Rust
- Embedded, scriptable terminal emulator
- Asynchronous job control
- Shared data (shada) among multiple editor instances
- XDG base directories support
- Compatible with most Vim plugins, including Ruby and Python plugins
See :help nvim-features
for the full list, and [:help news][nvim-news]
for noteworthy changes in the latest version!
Install from package
Pre-built packages for Windows, macOS, and Linux are found on the Releases page.
Managed packages are in Homebrew, Debian, Ubuntu, Fedora, Arch Linux, Void Linux, Gentoo, and more!
Install from source
See the Building Neovim wiki page and supported platforms for details.
The build is CMake-based, but a Makefile is provided as a convenience. After installing the dependencies, run the following command.
make CMAKE_BUILD_TYPE=RelWithDebInfo
sudo make install
To install to a non-default location:
make CMAKE_BUILD_TYPE=RelWithDebInfo CMAKE_INSTALL_PREFIX=/full/path/
make install
CMake hints for inspecting the build:
cmake --build build --target help
lists all build targets.build/CMakeCache.txt
(orcmake -LAH build/
) contains the resolved values of all CMake variables.build/compile_commands.json
shows the full compiler invocations for each translation unit.
Transitioning from Vim
See :help nvim-from-vim
for instructions.
Project layout
├─ ci/ build automation
├─ cmake/ CMake utils
├─ cmake.config/ CMake defines
├─ cmake.deps/ subproject to fetch and build dependencies (optional)
├─ runtime/ plugins and docs
├─ src/nvim/ application source code (see src/nvim/README.md)
│ ├─ api/ API subsystem
│ ├─ eval/ VimL subsystem
│ ├─ event/ event-loop subsystem
│ ├─ generators/ code generation (pre-compilation)
│ ├─ lib/ generic data structures
│ ├─ lua/ Lua subsystem
│ ├─ msgpack_rpc/ RPC subsystem
│ ├─ os/ low-level platform code
│ └─ tui/ built-in UI
└─ test/ tests (see test/README.md)
License
Neovim contributions since b17d96 are licensed under the
Apache 2.0 license, except for contributions copied from Vim (identified by the
vim-patch
token). See LICENSE for details.
Vim is Charityware. You can use and copy it as much as you like, but you are
encouraged to make a donation for needy children in Uganda. Please see the
kcc section of the vim docs or visit the ICCF web site, available at these URLs:
http://iccf-holland.org/
http://www.vim.org/iccf/
http://www.iccf.nl/
You can also sponsor the development of Vim. Vim sponsors can vote for
features. The money goes to Uganda anyway.