diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2026-09-11 10:41:59 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-09-11 02:41:59 +0000 |
| commit | ce5dc72a2322b881a5e73f55fadcd8d6c6020d5a (patch) | |
| tree | c6cf5a4a59f12706ea6c1d7bbeaae210241c1dc9 /runtime/lua/vim/async/_queue.lua | |
| parent | e25e86a9edcb0ba77ead2de244d9da7ffd12161e (diff) | |
| download | rneovim-ce5dc72a2322b881a5e73f55fadcd8d6c6020d5a.tar.gz rneovim-ce5dc72a2322b881a5e73f55fadcd8d6c6020d5a.tar.bz2 rneovim-ce5dc72a2322b881a5e73f55fadcd8d6c6020d5a.zip | |
vim-patch:9.2.1065: possible heap-use-after-free in ml_setname() (#41848)
Problem: possible heap-use-after-free in ml_setname()
Solution: After findswapname() returns, verify that buf->b_ml.ml_mfp is
still the same as the copy mfp we hold (Zdenek Dohnal).
If findswapname() creates a different swap filename which does not
match with the old one, it looks possible to free the mfp in buf.
The commit adds additional protection.
related: vim/vim#21171
closes: vim/vim#21261
https://github.com/vim/vim/commit/607472e053a0972aaa83b1e4da13052ee0674368
Co-authored-by: Zdenek Dohnal <zdohnal@redhat.com>
Diffstat (limited to 'runtime/lua/vim/async/_queue.lua')
0 files changed, 0 insertions, 0 deletions