diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2024-08-16 09:00:50 +0800 |
|---|---|---|
| committer | zeertzjq <zeertzjq@outlook.com> | 2024-08-17 06:04:52 +0800 |
| commit | b3d291c5656085189e1ba65357119f16e2f5e9b0 (patch) | |
| tree | b49afe5c2b1ac440ec6ba5b0fdcb82bb32e4740c /src/nvim/ex_cmds.c | |
| parent | 8b8096500d08d771a936d8ceca25ef5716c3874f (diff) | |
| download | rneovim-b3d291c5656085189e1ba65357119f16e2f5e9b0.tar.gz rneovim-b3d291c5656085189e1ba65357119f16e2f5e9b0.tar.bz2 rneovim-b3d291c5656085189e1ba65357119f16e2f5e9b0.zip | |
vim-patch:9.1.0678: [security]: use-after-free in alist_add()
Problem: [security]: use-after-free in alist_add()
(SuyueGuo)
Solution: Lock the current window, so that the reference to
the argument list remains valid.
This fixes CVE-2024-43374
https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8
Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'src/nvim/ex_cmds.c')
| -rw-r--r-- | src/nvim/ex_cmds.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/nvim/ex_cmds.c b/src/nvim/ex_cmds.c index 6a7a713d39..1cfdd844a7 100644 --- a/src/nvim/ex_cmds.c +++ b/src/nvim/ex_cmds.c @@ -2349,7 +2349,7 @@ int do_ecmd(int fnum, char *ffname, char *sfname, exarg_T *eap, linenr_T newlnum // Set w_closing to avoid that autocommands close the window. // Set b_locked for the same reason. - the_curwin->w_closing = true; + the_curwin->w_locked = true; buf->b_locked++; if (curbuf == old_curbuf.br_buf) { @@ -2365,7 +2365,7 @@ int do_ecmd(int fnum, char *ffname, char *sfname, exarg_T *eap, linenr_T newlnum // Autocommands may have closed the window. if (win_valid(the_curwin)) { - the_curwin->w_closing = false; + the_curwin->w_locked = false; } buf->b_locked--; |