thac0/vim
1
0
Fork 0
forked from aniani/vim
Code Activity

patch 9.1.0764: [security]: use-after-free when closing a buffer

Browse Source 
Problem:  [security]: use-after-free when closing a buffer
Solution: When splitting the window and editing a new buffer,
          check whether the newly to be edited buffer has been marked
          for deletion and abort in this case

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-rj48-v4mq-j4vg

Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Christian Brabandt
2024-10-06 17:31:10 +02:00
parent 818c641b6f
commit 51b62387be
5 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/ex_cmds.c
View File

@@ -2743,6 +2743,18 @@ do_ecmd(
}
if (buf == NULL)
goto theend;
// autocommands try to edit a file that is goind to be removed,
// abort
if (buf_locked(buf))
{
// window was split, but not editing the new buffer,
// reset b_nwindows again
if (oldwin == NULL
&& curwin->w_buffer != NULL
&& curwin->w_buffer->b_nwindows > 1)
--curwin->w_buffer->b_nwindows;
goto theend;
}
if (curwin->w_alt_fnum == buf->b_fnum && prev_alt_fnum != 0)
// reusing the buffer, keep the old alternate file
curwin->w_alt_fnum = prev_alt_fnum;