From 2e621553c089ca6b7de5123a9c63a7a54ee06c20 Mon Sep 17 00:00:00 2001 From: Abdelhakeem Osama Date: Sun, 25 Aug 2019 10:11:22 +0300 Subject: teardown: fix win_free_all() heap-use-after-free #10839 Fixes #10838 --- src/nvim/window.c | 3 +++ test/functional/api/vim_spec.lua | 5 +++++ 2 files changed, 8 insertions(+) diff --git a/src/nvim/window.c b/src/nvim/window.c index 4173245439..b5d34bbbdb 100644 --- a/src/nvim/window.c +++ b/src/nvim/window.c @@ -2698,6 +2698,9 @@ void win_free_all(void) win_T *wp = lastwin; win_remove(lastwin, NULL); (void)win_free_mem(wp, &dummy, NULL); + if (wp == aucmd_win) { + aucmd_win = NULL; + } } if (aucmd_win != NULL) { diff --git a/test/functional/api/vim_spec.lua b/test/functional/api/vim_spec.lua index cd45914552..0cd81619c1 100644 --- a/test/functional/api/vim_spec.lua +++ b/test/functional/api/vim_spec.lua @@ -1510,5 +1510,10 @@ describe('API', function() | ]]) end) + + it('does not cause heap-use-after-free on exit while setting options', function() + command('au OptionSet * q') + command('silent! call nvim_create_buf(0, 1)') + end) end) end) -- cgit