diff options
| author | Sean Dewar <6256228+seandewar@users.noreply.github.com> | 2024-02-25 01:30:37 +0000 |
|---|---|---|
| committer | Sean Dewar <6256228+seandewar@users.noreply.github.com> | 2024-03-08 23:24:05 +0000 |
| commit | 832bc5c169d8b339ef139ef0bdcefb2e72864e6e (patch) | |
| tree | f6f9da93611a71ca265e1179ea2bf18852685762 | |
| parent | e3d4dfb6c3fcd22205f6843b96f9a043871113ce (diff) | |
| download | rneovim-832bc5c169d8b339ef139ef0bdcefb2e72864e6e.tar.gz rneovim-832bc5c169d8b339ef139ef0bdcefb2e72864e6e.tar.bz2 rneovim-832bc5c169d8b339ef139ef0bdcefb2e72864e6e.zip | |
vim-patch:9.1.0130: [security]: UAF if win_split_ins autocommands delete "wp"
Problem: heap-use-after-free in win_splitmove if Enter/Leave
autocommands from win_split_ins immediately closes "wp".
Solution: check that "wp" is valid after win_split_ins.
(Sean Dewar)
https://github.com/vim/vim/commit/abf7030a5c22257f066fa9c4061ad150d5a82577
| -rw-r--r-- | src/nvim/window.c | 4 | ||||
| -rw-r--r-- | test/old/testdir/test_window_cmd.vim | 9 |
2 files changed, 11 insertions, 2 deletions
diff --git a/src/nvim/window.c b/src/nvim/window.c index 2d0010ad6c..80cb9ab6a0 100644 --- a/src/nvim/window.c +++ b/src/nvim/window.c @@ -1948,8 +1948,8 @@ int win_splitmove(win_T *wp, int size, int flags) } // If splitting horizontally, try to preserve height. - // Note that win_split_ins autocommands may have immediately made "wp" floating! - if (size == 0 && !(flags & WSP_VERT) && !wp->w_floating) { + // Note that win_split_ins autocommands may have immediately closed "wp", or made it floating! + if (size == 0 && !(flags & WSP_VERT) && win_valid(wp) && !wp->w_floating) { win_setheight_win(height, wp); if (p_ea) { // Equalize windows. Note that win_split_ins autocommands may have diff --git a/test/old/testdir/test_window_cmd.vim b/test/old/testdir/test_window_cmd.vim index 7ea556b11f..e6d591f8c9 100644 --- a/test/old/testdir/test_window_cmd.vim +++ b/test/old/testdir/test_window_cmd.vim @@ -1150,6 +1150,15 @@ func Test_win_splitmove() call assert_equal(v:true, s:triggered) unlet! s:triggered + split + let close_win = winnr('#') + augroup WinSplitMove + au! + au WinEnter * ++once quit! + augroup END + call win_splitmove(close_win, winnr()) + call assert_equal(0, win_id2win(close_win)) + au! WinSplitMove augroup! WinSplitMove %bw! |