vim-patch:9.1.0648: [security] double-free in dialog_changed()

Problem:  [security] double-free in dialog_changed()
          (SuyueGuo)
Solution: Only clear pointer b_sfname pointer, if it is different
          than the b_ffname pointer.  Don't try to free b_fname,
          set it to NULL instead.

fixes: vim/vim#15403

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-46pw-v7qw-xc2f

https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48c9de60

Co-authored-by: Christian Brabandt <cb@256bit.org>

1 files changed, 12 insertions, 0 deletions

diff --git a/test/functional/legacy/crash_spec.lua b/test/functional/legacy/crash_spec.lua
index e72c3a512a..b63b3146f4 100644
--- a/test/functional/legacy/crash_spec.lua
+++ b/test/functional/legacy/crash_spec.lua
@@ -8,6 +8,7 @@ local eq = t.eq
 local eval = n.eval
 local exec = n.exec
 local feed = n.feed
+local pcall_err = t.pcall_err
 
 before_each(clear)
 
@@ -51,3 +52,14 @@ it('no crash when closing window with tag in loclist', function()
   eq(0, eval('bufexists(g:qf_bufnr)'))
   assert_alive()
 end)
+
+it('no crash when writing "Untitled" file fails', function()
+  t.mkdir('Untitled')
+  finally(function()
+    vim.uv.fs_rmdir('Untitled')
+  end)
+  feed('ifoobar')
+  command('set bufhidden=unload')
+  eq('Vim(enew):E502: "Untitled" is a directory', pcall_err(command, 'confirm enew'))
+  assert_alive()
+end)