diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2024-08-03 08:13:20 +0800 |
|---|---|---|
| committer | zeertzjq <zeertzjq@outlook.com> | 2024-08-03 08:25:43 +0800 |
| commit | 6967c08840bedfecc54884af815b75ff7ab7af7b (patch) | |
| tree | c8a71350c5e5bc69fb5fabf837f2902d9bb8ac4e /src | |
| parent | 383f6934720a203d093c762cbd5362092110f35f (diff) | |
| download | rneovim-6967c08840bedfecc54884af815b75ff7ab7af7b.tar.gz rneovim-6967c08840bedfecc54884af815b75ff7ab7af7b.tar.bz2 rneovim-6967c08840bedfecc54884af815b75ff7ab7af7b.zip | |
vim-patch:9.1.0648: [security] double-free in dialog_changed()
Problem: [security] double-free in dialog_changed()
(SuyueGuo)
Solution: Only clear pointer b_sfname pointer, if it is different
than the b_ffname pointer. Don't try to free b_fname,
set it to NULL instead.
fixes: vim/vim#15403
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-46pw-v7qw-xc2f
https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48c9de60
Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/nvim/ex_cmds2.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/src/nvim/ex_cmds2.c b/src/nvim/ex_cmds2.c index a602719f6d..b62bb8b42a 100644 --- a/src/nvim/ex_cmds2.c +++ b/src/nvim/ex_cmds2.c @@ -227,9 +227,12 @@ void dialog_changed(buf_T *buf, bool checkall) // restore to empty when write failed if (empty_bufname) { - XFREE_CLEAR(buf->b_fname); + // prevent double free + if (buf->b_sfname != buf->b_ffname) { + XFREE_CLEAR(buf->b_sfname); + } + buf->b_fname = NULL; XFREE_CLEAR(buf->b_ffname); - XFREE_CLEAR(buf->b_sfname); unchanged(buf, true, false); } } else if (ret == VIM_NO) { |