From 6967c08840bedfecc54884af815b75ff7ab7af7b Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Sat, 3 Aug 2024 08:13:20 +0800 Subject: vim-patch:9.1.0648: [security] double-free in dialog_changed() Problem: [security] double-free in dialog_changed() (SuyueGuo) Solution: Only clear pointer b_sfname pointer, if it is different than the b_ffname pointer. Don't try to free b_fname, set it to NULL instead. fixes: vim/vim#15403 Github Advisory: https://github.com/vim/vim/security/advisories/GHSA-46pw-v7qw-xc2f https://github.com/vim/vim/commit/b29f4abcd4b3382fa746edd1d0562b7b48c9de60 Co-authored-by: Christian Brabandt --- src/nvim/ex_cmds2.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/nvim/ex_cmds2.c b/src/nvim/ex_cmds2.c index a602719f6d..b62bb8b42a 100644 --- a/src/nvim/ex_cmds2.c +++ b/src/nvim/ex_cmds2.c @@ -227,9 +227,12 @@ void dialog_changed(buf_T *buf, bool checkall) // restore to empty when write failed if (empty_bufname) { - XFREE_CLEAR(buf->b_fname); + // prevent double free + if (buf->b_sfname != buf->b_ffname) { + XFREE_CLEAR(buf->b_sfname); + } + buf->b_fname = NULL; XFREE_CLEAR(buf->b_ffname); - XFREE_CLEAR(buf->b_sfname); unchanged(buf, true, false); } } else if (ret == VIM_NO) { -- cgit