vim-patch:9.2.0461: Corrupted undofile causes use-after-free (#39707)

Problem:  The four pointer-resolution loops in u_read_undo() lack
          an i != j guard, so a header whose uh_next.seq equals
          its own uh_seq resolves uh_next.ptr to itself.  On
          buffer close, u_freeheader() sees uhp->uh_next.ptr !=
          NULL and skips updating b_u_oldhead, so u_blockfree()
          dereferences the freed header on the next iteration.
          The same pattern applies to uh_prev, uh_alt_next and
          uh_alt_prev.  A crafted .un~ file in the same directory
          as a text file can trigger the use-after-free and
          subsequent double-free when the buffer is closed.
          (Daniel Cervera)
Solution: Add an i != j guard to each of the four resolution
          loops, matching the guard already present in the
          duplicate-detection loop above.

closes: vim/vim#20168

Supported by AI

https://github.com/vim/vim/commit/4f610f07b76b4f34d011179c2531ab4517ac11e8

Co-authored-by: Christian Brabandt <cb@256bit.org>

0 files changed, 0 insertions, 0 deletions