diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2024-10-07 10:40:44 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-10-07 10:40:44 +0800 |
| commit | 2377443cd27ac41429d77fc6ba41e21469ed3b5b (patch) | |
| tree | daa0fd0c7557b5add1814159bb2882266493f0a4 /src/nvim/buffer.c | |
| parent | bf868e76e14447c7fed0c9a778f2e0ec4cb5011a (diff) | |
| download | rneovim-2377443cd27ac41429d77fc6ba41e21469ed3b5b.tar.gz rneovim-2377443cd27ac41429d77fc6ba41e21469ed3b5b.tar.bz2 rneovim-2377443cd27ac41429d77fc6ba41e21469ed3b5b.zip | |
vim-patch:9.1.0764: [security]: use-after-free when closing a buffer (#30705)
Problem: [security]: use-after-free when closing a buffer
Solution: When splitting the window and editing a new buffer,
check whether the newly to be edited buffer has been marked
for deletion and abort in this case
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-rj48-v4mq-j4vg
https://github.com/vim/vim/commit/51b62387be93c65fa56bbabe1c3c1ea5df187641
Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'src/nvim/buffer.c')
| -rw-r--r-- | src/nvim/buffer.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/nvim/buffer.c b/src/nvim/buffer.c index 271f3fa725..4a87cebfa7 100644 --- a/src/nvim/buffer.c +++ b/src/nvim/buffer.c @@ -478,6 +478,11 @@ static bool can_unload_buffer(buf_T *buf) return can_unload; } +bool buf_locked(buf_T *buf) +{ + return buf->b_locked || buf->b_locked_split; +} + /// Close the link to a buffer. /// /// @param win If not NULL, set b_last_cursor. |