diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2023-11-17 09:47:04 +0800 |
|---|---|---|
| committer | zeertzjq <zeertzjq@outlook.com> | 2023-11-17 09:59:22 +0800 |
| commit | 790bd4d5858713e8503825892c7d08340d189370 (patch) | |
| tree | ad5cc30e6ddb2202fb7e15aa081d9a7c7efb06d4 /src/nvim/window.c | |
| parent | d49be1cd2893ad583361ac058279a471ad7877e5 (diff) | |
| download | rneovim-790bd4d5858713e8503825892c7d08340d189370.tar.gz rneovim-790bd4d5858713e8503825892c7d08340d189370.tar.bz2 rneovim-790bd4d5858713e8503825892c7d08340d189370.zip | |
vim-patch:9.0.2106: [security]: Use-after-free in win_close()
Problem: [security]: Use-after-free in win_close()
Solution: Check window is valid, before accessing it
If the current window structure is no longer valid (because a previous
autocommand has already freed this window), fail and return before
attempting to set win->w_closing variable.
Add a test to trigger ASAN in CI
https://github.com/vim/vim/commit/25aabc2b8ee1e19ced6f4da9d866cf9378fc4c5a
Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'src/nvim/window.c')
| -rw-r--r-- | src/nvim/window.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/nvim/window.c b/src/nvim/window.c index 89bdd7f5e0..00524b2f56 100644 --- a/src/nvim/window.c +++ b/src/nvim/window.c @@ -2661,6 +2661,9 @@ int win_close(win_T *win, bool free_buf, bool force) reset_VIsual_and_resel(); // stop Visual mode other_buffer = true; + if (!win_valid(win)) { + return FAIL; + } win->w_closing = true; apply_autocmds(EVENT_BUFLEAVE, NULL, NULL, false, curbuf); if (!win_valid(win)) { |