diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2026-08-29 08:33:38 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-08-29 08:33:38 +0800 |
| commit | 5de6537c420e8d2af6b19aba0fcac253c9cbe92f (patch) | |
| tree | 59e5761c164bd4e3a2ce82f91b45e7c2b84bdb19 /runtime/syntax/python.vim | |
| parent | 61958f233584b0c75f6dbc650d6b1d3c01096404 (diff) | |
| download | rneovim-5de6537c420e8d2af6b19aba0fcac253c9cbe92f.tar.gz rneovim-5de6537c420e8d2af6b19aba0fcac253c9cbe92f.tar.bz2 rneovim-5de6537c420e8d2af6b19aba0fcac253c9cbe92f.zip | |
vim-patch:9.2.1017: heap-use-after-free in ml_open_file() (#41533)
Problem: A SwapExists autocmd can re-open the buffer being edited,
causing ml_close() to free the memfile that
ml_open_file() still holds a local pointer to, causing
use-after-free.
Solution: After findswapname() returns, verify that buf->b_ml.ml_mfp
is still the same as the copy mfp we hold.
closes: vim/vim#21171
https://github.com/vim/vim/commit/7aecb2cca89cfd61741c0b2a3cf8cdac2ebf5e29
Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'runtime/syntax/python.vim')
0 files changed, 0 insertions, 0 deletions