Re: another security related problem with symlinks?

[Bram Moolenaar]

Christian wrote:

> Hi Bram,
> just wanted to point you to this thread from the oss-security list:
> http://www.openwall.com/lists/oss-security/2017/11/13/3
> 
> I don't claim to fully understand that PoC. So I leave that to someone 
> more knowledgable than me.

Thanks.  I'll have a look.

I always wonder why something like this isn't directly sent to me
instead of to some random distribution that includes Vim.

-- 
A salesperson says:Translation:
"backward compatible"  Old technology
"Premium"  Overpriced
"Can't keep it on the shelf"   Unavailable
"Stands alone" Piece of shit
"Proprietary"  Incompatible
(Scott Adams - The Dilbert principle)

 /// Bram Moolenaar -- b...@moolenaar.net -- http://www.Moolenaar.net   \\\
///sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\  an exciting new programming language -- http://www.Zimbu.org///
 \\\help me help AIDS victims -- http://ICCF-Holland.org///

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to vim_dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [PATCH v2] viminfo: always enforce viminfo with mode 0600

[Bram Moolenaar]

Simon Ruderich wrote:

> On Mon, Nov 13, 2017 at 11:06:33PM +0100, Bram Moolenaar wrote:
> > If .viminfo.tmp already exists, Vim will try .viminfz.tmp, .viminfy.tmp,
> > etc.
> >
> > if .viminfo.tmp does not exist at first, but shows up in between the
> > stat() and the open() then the user is doing something really weird.
> > Or there is some corner case I can't imagine?
> 
> Yes, the corner case is that two (ore more) Vims at the same time
> concurrently try to write the viminfo. This can for example
> happen if you logout from your X session but have multiple Vims
> running which receive a SIGHUP at the same time and while dying
> will update the viminfo.

OK, I assumed this was really never happening.  But indeed, if there are
multiple Vim processes that all get the same signal at the same time,
it's much more likely to happen.

The usual solution is to not use stat() and then open(), but use open()
with the right flags to fail when the file exists, and deal with the
error.  Best is to do both, because some systems don't handle O_EXCL
properly (see the code for shortname above).  And overwriting the
original file is pretty bad.

> Then all Vims will first stat .viminfo.tmp, not find it, but only
> the first will succeed in creating it, this will trigger the if
> in this code:
> 
> /*
>  * If we can't create in the same directory, try creating a
>  * "normal" temp file.  This is just an attempt, renaming the temp
>  * file might fail as well.
>  */
> if (fp_out == NULL)
> 
> But here the umask is not changed when creating the file,
> resulting in a viminfo readable by _all_ users.
> 
> >> I just saw the patch and I'm not sure what it's supposed to do.
> >> It only enforces the same user/group but doesn't affect any
> >> permissions and therefore can't fix the original issue.
> >
> > It fixes the case where the user's primary group gives more permissions
> > than intended, and the viminfo has been given group read and/or write
> > permission, and somehow has a different group.  Lots of conditions, so
> > no surprise nobody ran into this.
> 
> Interesting, thanks.
> 
> >> TL;DR: please ignore this patch and apply "Possible security
> >> issue: [PATCH] viminfo: create fallback tempfile with restrictive
> >> umask" (Message-ID:
> >> <975991f5f00163b45d9ae1bb108a1a0064fa1f09.1510059861.git.si...@ruderich.org>)
> >> to fix the original race condition which makes the .viminfo
> >> readable by _all_ users.
> >
> > That's already done.  But keeping the group bits if possible.
> 
> No, that's the wrong patch. I'm talking about this one (my
> original patch). It's required to fix the race condition.

Using the temp file does not have the race condition, since every Vim
has its own unique temp directory.


-- 
At some point in the project somebody will start whining about the need to
determine the project "requirements".  This involves interviewing people who
don't know what they want but, curiously, know exactly when they need it.
(Scott Adams - The Dilbert principle)

 /// Bram Moolenaar -- b...@moolenaar.net -- http://www.Moolenaar.net   \\\
///sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\  an exciting new programming language -- http://www.Zimbu.org///
 \\\help me help AIDS victims -- http://ICCF-Holland.org///

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to vim_dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [win32][patch] Fix that sometimes the intro message is not shown

[Bram Moolenaar]

Ken Takata wrote:

> I found that sometimes resizing event is sent to Vim on Win32 console even if
> the console size is not changed.  I don't know what is the trigger of this,
> but this can happen on the start up and it clears the intro message.
> 
> The following patch fixes the problem:
> https://bitbucket.org/k_takata/vim-ktakata-mq/src/a54c2c07dca68996c833adbc994e1caa822928c9/win32-dont-resize-if-not-needed.patch?fileviewer=file-view-default

Thanks, I'll put it in the todo list.

-- 
The budget process was invented by an alien race of sadistic beings who
resemble large cats.
(Scott Adams - The Dilbert principle)

 /// Bram Moolenaar -- b...@moolenaar.net -- http://www.Moolenaar.net   \\\
///sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\  an exciting new programming language -- http://www.Zimbu.org///
 \\\help me help AIDS victims -- http://ICCF-Holland.org///

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to vim_dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: Patch 8.0.1298

[Christian Brabandt]

On Di, 14 Nov 2017, Bram Moolenaar wrote:

> *** ../vim-8.0.1297/src/testdir/samples/test000   2017-11-14 
> 20:22:46.056934652 +0100
> --- src/testdir/samples/test000   2017-11-14 20:17:50.289247116 +0100
> ***
> *** 0 
> --- 1 
> + ÿþ

That patch looks incomplete. But I see that on github the patch looks 
correct. Perhaps your toolchain cannot handle binary diffs?

Christian
-- 
Die Menschen glauben, dass man sich mit ihnen abgeben müsse, da 
man sich mit ihnen abgeben müsse, da man sich mit sich selbst nicht 
abgibt.
-- Goethe, Maximen und Reflektionen, Nr. 705

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to vim_dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[patch] fixed typos in documentation

[Dominique Pellé]

Hi

Attached patch fixes typos in Vim documentation.

Regards
Dominique

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to vim_dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
diff --git a/runtime/doc/options.txt b/runtime/doc/options.txt
index b9e82d7..877de08 100644
--- a/runtime/doc/options.txt
+++ b/runtime/doc/options.txt
@@ -3944,7 +3944,7 @@ A jump table for the options with a short description can be found at |Q_op|.
 		toolbar, tabline, etc.  Instead, the behavior is similar to
 		when the window is maximized and will adjust 'lines' and
 		'columns' to fit to the window.  Without the 'k' flag Vim will
-		try to keep 'lines' and 'columns the same when adding and
+		try to keep 'lines' and 'columns' the same when adding and
 		removing GUI components.
 
 		*'guipty'* *'noguipty'*
diff --git a/runtime/doc/todo.txt b/runtime/doc/todo.txt
index 44d002b..413afb5 100644
--- a/runtime/doc/todo.txt
+++ b/runtime/doc/todo.txt
@@ -136,7 +136,7 @@ Regexp problems:
 Include a few color schemes, based on popularity:
 http://www.vim.org/scripts/script_search_results.php?keywords=_type=color+scheme_by=rating=descending=search
 http://vimawesome.com/?q=tag:color-scheme
-Use names that indicate their apperance (Christian Brabandt, 2017 Aug 3)
+Use names that indicate their appearance (Christian Brabandt, 2017 Aug 3)
 - monokai - Xia Crusoe (2017 Aug 4) 
 - seoul256 - Christian Brabandt (2017 Aug 3)
 - gruvbox -  Christian Brabandt (2017 Aug 3)
@@ -4653,7 +4653,7 @@ Command line history:
 -   Add "KeyWasTyped" flag: It's reset before each command and set when a
 character from the keyboard is consumed. Value is used to decide to put a
 command line in history or not. Put line in history if it didn't
-completely resulted from one mapping.
+completely result from one mapping.
 -   When using ":browse", also put the resulting edit command in the history,
 so that it can be repeated. (Demirel)
 

Re: [vim/vim] Search for Russian letter range `[а-яА-Я ]` misses the letters `ё` and `Ё` (#1751)

[Marvin Renich]

* Marvin Renich  [171114 14:57]:
> It suggests using [[:lower:][:upper:]] to do something close to what you
> want (it will also find non-Russian letters).  The help does not mention
> any character class that includes exactly Russian letters, so the best
> you are going to be able to do is [А-яЁё].

If encoding is cp1251, [[:alpha:]] might work (i.e. find ASCII and
Russian letters, including Ё and ё), since that is an 8-bit encoding,
but I haven't tried it.

...Marvin

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to vim_dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [vim/vim] Search for Russian letter range `[а-яА-Я ]` misses the letters `ё` and `Ё` (#1751)

[Marvin Renich]

* sergeevabc  [171114 08:15]:
> @10110111, stumbled upon your comment accidentally and decided to test on my 
> end.
> ```
> $ set LC_ALL=ru_RU.utf8
> 
> $ grep --version
> grep (GNU grep) 3.0
> 
> $ echo Ёжик под зелёной ёлкой. | grep --color "[а-яА-Я ]"
> Ёжик под зелёной ёлкой.
> ^   ^^^
> ```
> Ё, ё and . are not painted red.

In vim patterns, [a-z] is a character range, not a character class.  It
specifically searches for characters whose code values are within the
range.  Ё and ё are outside the range [а-яА-Я ] for both cp1251 and
utf-8.

If you read at :help /collections and go down to the discussion of
character classes, you will notice that it has character classes for
[:alpha:], [:lower:], and [:upper:], among others.  It also says

  These items only work for 8-bit characters, except [:lower:] and
  [:upper:] also work for multi-byte characters when using the new
  regexp engine.

It suggests using [[:lower:][:upper:]] to do something close to what you
want (it will also find non-Russian letters).  The help does not mention
any character class that includes exactly Russian letters, so the best
you are going to be able to do is [А-яЁё].

Vim's regexp engine is working as defined; the fact that Unicode and
cp1251 do not have all the Russian alphabetic characters in a single
range is the issue.  You could request that a character class be added
to do what you want; if you can also provide a patch, that would
significantly increase the chance that the feature would be added.

...Marvin

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to vim_dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: Patch 8.0.1227

[Bram Moolenaar]

Christian wrote:

> > > On Mo, 13 Nov 2017, Bram Moolenaar wrote:
> > > 
> > > > I didn't receive a proper patch, only a git binary diff.
> > > > Can you send me the file as an attachment?
> > > 
> > > git apply should be able to apply it nevertheless.
> > 
> > error: git diff header lacks filename information when removing 1 leading 
> > pathname component (line 14)
> 
> That is surprising. I attach the file here. Hopefully, sending it by 
> mail does not mangle it.

Yes, this works.

> > > However the file is 
> > > this one:
> > > https://github.com/vim/vim/issues/2253
> > 
> > Hmm, is that just one zero character?
> 
> Yeah, that interesting part is that it is a ucs4-le file encoding, else 
> I would have written the test to create a sample file, but did not know 
> how to do it for ucs4-le.

Let's see what diff does with this binary file...

-- 
If your company is not involved in something called "ISO 9000" you probably
have no idea what it is.  If your company _is_ involved in ISO 9000 then you
definitely have no idea what it is.
(Scott Adams - The Dilbert principle)

 /// Bram Moolenaar -- b...@moolenaar.net -- http://www.Moolenaar.net   \\\
///sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\  an exciting new programming language -- http://www.Zimbu.org///
 \\\help me help AIDS victims -- http://ICCF-Holland.org///

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to vim_dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [vim/vim] Search for Russian letter range `[а-яА-Я ]` misses the letters `ё` and `Ё` (#1751)

[Tony Mechelynck]

This (not catching Ёё with [А-Яа-я]) is expected when $LC_COLLATE is a
locale with no knowledge of Cyrillic alphabetization, for instance C:

Ё U+0401 CYRILLIC CAPITAL LETTER IO
А U+0410 CYRILLIC CAPITAL LETTER A
Я U+042F CYRILLIC CAPITAL LETTER YA
а U+0430 CYRILLIC SMALL LETTER A
я U+044F CYRILLIC SMALL LETTER YA
ё U+0451 CYRILLIC SMALL LETTER IO

As you can see, Cyrillic Ё and ё are outside the range [А-Яа-я]. This
is why, under ":help /[], the pattern [А-яЁё] is mentioned to catch
all (Russian) Cyrillic letters.

OTOH, with $LC_COLLATE set to some Cyrillic locale (and assuming Vim
takes it into consideration, about which I'm not sure), Ё and ё sort
together with Е and е, between Дд and Жж, so they would be included.

Best regards,
Tony.

On Tue, Nov 14, 2017 at 2:15 PM, sergeevabc  wrote:
> @10110111, stumbled upon your comment accidentally and decided to test on my
> end.
>
> $ set LC_ALL=ru_RU.utf8
>
> $ grep --version
> grep (GNU grep) 3.0
>
> $ echo Ёжик под зелёной ёлкой. | grep --color "[а-яА-Я ]"
> Ёжик под зелёной ёлкой.
> ^   ^^^
>
> Ё, ё and . are not painted red.
>
> —
> You are receiving this because you commented.
> Reply to this email directly, view it on GitHub
>
> --
> --
> You received this message from the "vim_dev" maillist.
> Do not top-post! Type your reply below the text you are replying to.
> For more information, visit http://www.vim.org/maillist.php
>
> ---
> You received this message because you are subscribed to the Google Groups
> "vim_dev" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to vim_dev+unsubscr...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to vim_dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[win32][patch] Fix that sometimes the intro message is not shown

[Ken Takata]

Hi,

I found that sometimes resizing event is sent to Vim on Win32 console even if
the console size is not changed.  I don't know what is the trigger of this,
but this can happen on the start up and it clears the intro message.

The following patch fixes the problem:
https://bitbucket.org/k_takata/vim-ktakata-mq/src/a54c2c07dca68996c833adbc994e1caa822928c9/win32-dont-resize-if-not-needed.patch?fileviewer=file-view-default

Regards,
Ken Takata

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to vim_dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [vim] issue with Alt-Shift-p in xterm since v8.0.0973

[Thomas FAIVRE]

Le lundi 13 novembre 2017 23:06:44 UTC+1, Bram Moolenaar a écrit :
> 
> What is 'term' set to?  And more:
>   set term?
xterm
>   echo v:termresponse
^[[>41;327;0c
>   echo t_RS
>   echo t_RC
> 
Those commands did not work, stating that the variables are not set. But I 
found their values using "set termcap":
t_RC=^[[?12$p
t_RS=^[P$q q^[\
> You can try this in your vimrc to workaround:
>   set t_RC= t_RS=
This workaround works!

I found out something while reproducing today, I cannot find the ". register in 
the viminfo file. It's kinda expected seeing its definition, but how a new 
instance of vim can have its ". register filled?

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to vim_dev+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.