diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2026-01-14 09:42:36 +0800 |
|---|---|---|
| committer | zeertzjq <zeertzjq@outlook.com> | 2026-01-14 13:56:01 +0800 |
| commit | 6fa2ebec6b244eea8dde01ca72deeebd4546e537 (patch) | |
| tree | 183bf9bc0ab30026245f12313b2cc5b2d8a804c9 /src/nvim/buffer.c | |
| parent | 328640aed0ff43680e0d58a045ec3eca83f04571 (diff) | |
| download | rneovim-6fa2ebec6b244eea8dde01ca72deeebd4546e537.tar.gz rneovim-6fa2ebec6b244eea8dde01ca72deeebd4546e537.tar.bz2 rneovim-6fa2ebec6b244eea8dde01ca72deeebd4546e537.zip | |
vim-patch:9.1.2023: [security]: Use-after-free in alist_add() with nasty autocmd
Problem: A BufAdd autocommand may cause alist_add() to use freed
memory, this is caused by the w_locked variable unset too
early (henices)
Solution: in trigger_undo_ftplugin() only set w_locked to false, if it
was false when calling the function.
related: v9.1.0678
closes: vim/vim#19023
https://github.com/vim/vim/commit/9266a2a19790dd3485b1dd32b3e27ba1d93e33d0
Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'src/nvim/buffer.c')
| -rw-r--r-- | src/nvim/buffer.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/nvim/buffer.c b/src/nvim/buffer.c index 85cb824389..fb8235c1b3 100644 --- a/src/nvim/buffer.c +++ b/src/nvim/buffer.c @@ -131,13 +131,14 @@ typedef enum { static void trigger_undo_ftplugin(buf_T *buf, win_T *win) { + const bool win_was_locked = win->w_locked; window_layout_lock(); buf->b_locked++; win->w_locked = true; // b:undo_ftplugin may be set, undo it do_cmdline_cmd("if exists('b:undo_ftplugin') | exe b:undo_ftplugin | endif"); buf->b_locked--; - win->w_locked = false; + win->w_locked = win_was_locked; window_layout_unlock(); } |