vim-patch:9.0.0614: SpellFileMissing autocmd may delete buffer

Problem:    SpellFileMissing autocmd may delete buffer.
Solution:   Disallow deleting the current buffer to avoid using freed memory.
https://github.com/vim/vim/commit/ef976323e770315b5fca544efb6b2faa25674d15

3 files changed, 21 insertions, 1 deletions

diff --git a/src/nvim/buffer.c b/src/nvim/buffer.c
index e3f923a2c0..29b00bad2a 100644
--- a/src/nvim/buffer.c
+++ b/src/nvim/buffer.c
@@ -93,6 +93,8 @@
 #endif
 
 static char *e_auabort = N_("E855: Autocommands caused command to abort");
+static char e_attempt_to_delete_buffer_that_is_in_use_str[]
+  = N_("E937: Attempt to delete a buffer that is in use: %s");
 
 // Number of times free_buffer() was called.
 static int buf_free_count = 0;
@@ -416,7 +418,9 @@ static bool can_unload_buffer(buf_T *buf)
     }
   }
   if (!can_unload) {
-    emsg(_("E937: Attempt to delete a buffer that is in use"));
+    char *fname = buf->b_fname != NULL ? buf->b_fname : buf->b_ffname;
+    semsg(_(e_attempt_to_delete_buffer_that_is_in_use_str),
+          fname != NULL ? fname : "[No Name]");
   }
   return can_unload;
 }
diff --git a/src/nvim/spell.c b/src/nvim/spell.c
index 7d2b58ff46..69c2b027bc 100644
--- a/src/nvim/spell.c
+++ b/src/nvim/spell.c
@@ -1511,6 +1511,10 @@ static void spell_load_lang(char_u *lang)
   sl.sl_slang = NULL;
   sl.sl_nobreak = false;
 
+  // Disallow deleting the current buffer.  Autocommands can do weird things
+  // and cause "lang" to be freed.
+  curbuf->b_locked++;
+
   // We may retry when no spell file is found for the language, an
   // autocommand may load it then.
   for (int round = 1; round <= 2; round++) {
@@ -1553,6 +1557,8 @@ static void spell_load_lang(char_u *lang)
     STRCPY(fname_enc + strlen(fname_enc) - 3, "add.spl");
     do_in_runtimepath((char *)fname_enc, DIP_ALL, spell_load_cb, &sl);
   }
+
+  curbuf->b_locked--;
 }
 
 // Return the encoding used for spell checking: Use 'encoding', except that we
diff --git a/src/nvim/testdir/test_autocmd.vim b/src/nvim/testdir/test_autocmd.vim
index 025bda4515..63ed3ff435 100644
--- a/src/nvim/testdir/test_autocmd.vim
+++ b/src/nvim/testdir/test_autocmd.vim
@@ -2752,6 +2752,16 @@ func Test_FileType_spell()
   setglobal spellfile=
 endfunc
 
+" this was wiping out the current buffer and using freed memory
+func Test_SpellFileMissing_bwipe()
+  next 0
+  au SpellFileMissing 0 bwipe
+  call assert_fails('set spell spelllang=0', 'E937:')
+
+  au! SpellFileMissing
+  bwipe
+endfunc
+
 " Test closing a window or editing another buffer from a FileChangedRO handler
 " in a readonly buffer
 func Test_FileChangedRO_winclose()