diff options
| author | Sean Dewar <6256228+seandewar@users.noreply.github.com> | 2024-02-25 01:30:37 +0000 |
|---|---|---|
| committer | Sean Dewar <6256228+seandewar@users.noreply.github.com> | 2024-03-08 23:24:05 +0000 |
| commit | 832bc5c169d8b339ef139ef0bdcefb2e72864e6e (patch) | |
| tree | f6f9da93611a71ca265e1179ea2bf18852685762 /src | |
| parent | e3d4dfb6c3fcd22205f6843b96f9a043871113ce (diff) | |
| download | rneovim-832bc5c169d8b339ef139ef0bdcefb2e72864e6e.tar.gz rneovim-832bc5c169d8b339ef139ef0bdcefb2e72864e6e.tar.bz2 rneovim-832bc5c169d8b339ef139ef0bdcefb2e72864e6e.zip | |
vim-patch:9.1.0130: [security]: UAF if win_split_ins autocommands delete "wp"
Problem: heap-use-after-free in win_splitmove if Enter/Leave
autocommands from win_split_ins immediately closes "wp".
Solution: check that "wp" is valid after win_split_ins.
(Sean Dewar)
https://github.com/vim/vim/commit/abf7030a5c22257f066fa9c4061ad150d5a82577
Diffstat (limited to 'src')
| -rw-r--r-- | src/nvim/window.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/nvim/window.c b/src/nvim/window.c index 2d0010ad6c..80cb9ab6a0 100644 --- a/src/nvim/window.c +++ b/src/nvim/window.c @@ -1948,8 +1948,8 @@ int win_splitmove(win_T *wp, int size, int flags) } // If splitting horizontally, try to preserve height. - // Note that win_split_ins autocommands may have immediately made "wp" floating! - if (size == 0 && !(flags & WSP_VERT) && !wp->w_floating) { + // Note that win_split_ins autocommands may have immediately closed "wp", or made it floating! + if (size == 0 && !(flags & WSP_VERT) && win_valid(wp) && !wp->w_floating) { win_setheight_win(height, wp); if (p_ea) { // Equalize windows. Note that win_split_ins autocommands may have |