aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-10-20 08:14:18 -04:00
Code Activity

patch 9.1.1361: [security]: possible use-after-free when closing a buffer

Browse Source 
Problem:  [security]: Possible to open more windows into a closing
          buffer without splitting, bypassing existing "b_locked_split"
          checks and triggering use-after-free
Solution: Disallow switching to a closing buffer. Editing a closing
          buffer (via ":edit", etc.) was fixed in v9.1.0764, but add an
          error message and check just "b_locked_split", as "b_locked"
          is necessary only when the buffer shouldn't be wiped, and may
          be set for buffers that are in-use but not actually closing.
          (Sean Dewar)

closes: #17246

Signed-off-by: Sean Dewar <6256228+seandewar@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Sean Dewar
2025-05-03 18:37:27 +02:00
committed by Christian Brabandt
parent c3f48e3a76
commit 6cb1c82840
8 changed files with 59 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/structs.h
View File

@@ -3072,7 +3072,7 @@ struct file_buffer
int b_locked; // Buffer is being closed or referenced, don't
// let autocommands wipe it out.
int b_locked_split; // Buffer is being closed, don't allow opening
// a new window with it.
// it in more windows.
/*
* b_ffname has the full path of the file (NULL for no name).