|
1 | | -*version9.txt* For Vim version 9.1. Last change: 2026 Feb 04 |
| 1 | +*version9.txt* For Vim version 9.1. Last change: 2026 Feb 09 |
2 | 2 |
|
3 | 3 |
|
4 | 4 | VIM REFERENCE MANUAL by Bram Moolenaar |
@@ -52474,8 +52474,79 @@ Solution: Fix incorrect return value of pagescroll(). Also invert the |
52474 | 52474 | match comments (zeertzjq). |
52475 | 52475 |
|
52476 | 52476 | Patch 9.1.2131 |
52477 | | - |
52478 | 52477 | Problem: tests: Test_diff_screen() fails on BSD |
52479 | 52478 | Solution: Use gdiff on BSD systems if available (zeertzjq). |
52480 | 52479 |
|
| 52480 | +Patch 9.1.2132 |
| 52481 | +Problem: [security]: buffer-overflow in 'helpfile' option handling by |
| 52482 | + using strcpy without bound checks (Rahul Hoysala) |
| 52483 | +Solution: Limit strncpy to the length of the buffer (MAXPATHL) |
| 52484 | + |
| 52485 | +Patch 9.1.2133 |
| 52486 | +Problem: Another case of buffer overflow with 'helpfile'. |
| 52487 | +Solution: Leave room for "tags" in the buffer (zeertzjq). |
| 52488 | + |
| 52489 | +Patch 9.1.2134 |
| 52490 | +Problem: Terminal doesn't handle split UTF-8 sequence after ASCII. |
| 52491 | +Solution: Only use one UTF-8 encoding state per vterm state (zeertzjq). |
| 52492 | + |
| 52493 | +Patch 9.1.2135 |
| 52494 | +Problem: search() is used to check for the message from tar that |
| 52495 | + indicates leading slashes found in the tar archive, or to |
| 52496 | + check for the leading slashes themselves. However, if |
| 52497 | + 'nowrapscan' is in effect these searches are limited to the |
| 52498 | + last line and don't find any results. This causes the warning |
| 52499 | + message from tar to be seen in the buffer, the "Path Traversal |
| 52500 | + Attack Detected" message to be omitted, and editing actions |
| 52501 | + can fail. This can be seen, for example, when editing |
| 52502 | + src/testdir/samples/evil.tar. |
| 52503 | +Solution: Use the 'w' flag for search() (Kevin Goodsell) |
| 52504 | + |
| 52505 | +Patch 9.1.2136 |
| 52506 | +Problem: :tab sbuffer may close old tabpage if BufLeave autocommand |
| 52507 | + splits window (after 9.1.0143). |
| 52508 | +Solution: Only close other windows if the buffer will be unloaded (zeertzjq). |
| 52509 | + |
| 52510 | +Patch 9.1.2137 |
| 52511 | +Problem: Some tests are not valid on OpenBSD. |
| 52512 | +Solution: Add CheckNotOpenBSD, use it to skip certain tests |
| 52513 | + (Kevin Goodsell). |
| 52514 | + |
| 52515 | +Patch 9.1.2138 |
| 52516 | +Problem: With 'autochdir' win_execute() can corrupt the buffer name, causing |
| 52517 | + :write to use wrong path. |
| 52518 | +Solution: Save and restore b_fname when 'autochdir' is active (Ingo Karkat). |
| 52519 | + |
| 52520 | +Patch 9.1.2139 |
| 52521 | +Problem: Buffer overflow in :wlrestore command, caused by assuming |
| 52522 | + wrong buffer length in vwl_log_handler() (Seungyeon Park) |
| 52523 | +Solution: Use correct buffer size (512 bytes) in vim_vsnprintf() |
| 52524 | + to properly truncate long messages. |
| 52525 | + |
| 52526 | +Patch 9.1.2140 |
| 52527 | +Problem: tests: Test_wayland_protocol_error_overflow() fails |
| 52528 | + (after v9.1.2139) |
| 52529 | +Solution: try/catch the expected error |
| 52530 | + |
| 52531 | +Patch 9.1.2141 |
| 52532 | +Problem: Truncation when serializing libsodium encryption parameters. |
| 52533 | +Solution: Correctly cast to long long type (Yasuhiro Matsumoto). |
| 52534 | + |
| 52535 | +Patch 9.1.2142 |
| 52536 | +Problem: MS-Windows: mouse scroll events not handled for popups |
| 52537 | +Solution: Do not return early (Mao-Yining) |
| 52538 | + |
| 52539 | +Patch 9.1.2143 |
| 52540 | +Problem: When a popup window partially overlaps a wide character |
| 52541 | + it results in truncated or garbage display. |
| 52542 | +Solution: When a wide character is partially blocked by a popup, clear both |
| 52543 | + cells in the screen buffer to prevent garbage (Yasuhiro Matsumoto). |
| 52544 | + |
| 52545 | +Patch 9.1.2144 |
| 52546 | +Problem: When garbage collection runs, the list of recorded buffer |
| 52547 | + changes may be incorrectly freed (Sainnhe Park). |
| 52548 | +Solution: In garbage_collect(), iterate through all buffers and call |
| 52549 | + set_ref_in_list() for b_recorded_changes to ensure the list |
| 52550 | + and its contents are marked as reachable (Paul Ollis). |
| 52551 | + |
52481 | 52552 | vim:tw=78:ts=8:noet:ft=help:norl:fdm=manual:nofoldenable |
0 commit comments