diff options
| author | Sean Dewar <6256228+seandewar@users.noreply.github.com> | 2024-02-25 01:30:37 +0000 |
|---|---|---|
| committer | Sean Dewar <6256228+seandewar@users.noreply.github.com> | 2024-03-08 23:24:05 +0000 |
| commit | 832bc5c169d8b339ef139ef0bdcefb2e72864e6e (patch) | |
| tree | f6f9da93611a71ca265e1179ea2bf18852685762 /test | |
| parent | e3d4dfb6c3fcd22205f6843b96f9a043871113ce (diff) | |
| download | rneovim-832bc5c169d8b339ef139ef0bdcefb2e72864e6e.tar.gz rneovim-832bc5c169d8b339ef139ef0bdcefb2e72864e6e.tar.bz2 rneovim-832bc5c169d8b339ef139ef0bdcefb2e72864e6e.zip | |
vim-patch:9.1.0130: [security]: UAF if win_split_ins autocommands delete "wp"
Problem: heap-use-after-free in win_splitmove if Enter/Leave
autocommands from win_split_ins immediately closes "wp".
Solution: check that "wp" is valid after win_split_ins.
(Sean Dewar)
https://github.com/vim/vim/commit/abf7030a5c22257f066fa9c4061ad150d5a82577
Diffstat (limited to 'test')
| -rw-r--r-- | test/old/testdir/test_window_cmd.vim | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/test/old/testdir/test_window_cmd.vim b/test/old/testdir/test_window_cmd.vim index 7ea556b11f..e6d591f8c9 100644 --- a/test/old/testdir/test_window_cmd.vim +++ b/test/old/testdir/test_window_cmd.vim @@ -1150,6 +1150,15 @@ func Test_win_splitmove() call assert_equal(v:true, s:triggered) unlet! s:triggered + split + let close_win = winnr('#') + augroup WinSplitMove + au! + au WinEnter * ++once quit! + augroup END + call win_splitmove(close_win, winnr()) + call assert_equal(0, win_id2win(close_win)) + au! WinSplitMove augroup! WinSplitMove %bw! |