aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-24 03:44:06 -04:00
Code Activity

patch 8.2.2476: using freed memory when splitting window while closing buffer

Browse Source 
Problem:    Using freed memory when using an autocommand to split a window
            while a buffer is being closed.
Solution:   Disallow splitting when the buffer has b_locked_split set.
This commit is contained in:
Bram Moolenaar
2021-02-07 12:12:43 +01:00
parent dfc3db76b9
commit 983d83ff1c
7 changed files with 26 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/buffer.c
View File

@@ -595,6 +595,7 @@ close_buffer(
if (buf->b_nwindows == 1)
{
++buf->b_locked;
++buf->b_locked_split;
if (apply_autocmds(EVENT_BUFWINLEAVE, buf->b_fname, buf->b_fname,
FALSE, buf)
&& !bufref_valid(&bufref))
@@ -605,6 +606,7 @@ aucmd_abort:
return FALSE;
}
--buf->b_locked;
--buf->b_locked_split;
if (abort_if_last && one_window())
// Autocommands made this the only window.
goto aucmd_abort;
@@ -614,12 +616,14 @@ aucmd_abort:
if (!unload_buf)
{
++buf->b_locked;
++buf->b_locked_split;
if (apply_autocmds(EVENT_BUFHIDDEN, buf->b_fname, buf->b_fname,
FALSE, buf)
&& !bufref_valid(&bufref))
// Autocommands deleted the buffer.
goto aucmd_abort;
--buf->b_locked;
--buf->b_locked_split;
if (abort_if_last && one_window())
// Autocommands made this the only window.
goto aucmd_abort;
@@ -800,6 +804,7 @@ buf_freeall(buf_T *buf, int flags)
// Make sure the buffer isn't closed by autocommands.
++buf->b_locked;
++buf->b_locked_split;
set_bufref(&bufref, buf);
if (buf->b_ml.ml_mfp != NULL)
{
@@ -826,6 +831,7 @@ buf_freeall(buf_T *buf, int flags)
return;
}
--buf->b_locked;
--buf->b_locked_split;
// If the buffer was in curwin and the window has changed, go back to that
// window, if it still exists. This avoids that ":edit x" triggering a
@@ -1718,8 +1724,8 @@ set_curbuf(buf_T *buf, int action)
set_bufref(&prevbufref, prevbuf);
set_bufref(&newbufref, buf);
// Autocommands may delete the current buffer and/or the buffer we want to go
// to. In those cases don't close the buffer.
// Autocommands may delete the current buffer and/or the buffer we want to
// go to. In those cases don't close the buffer.
if (!apply_autocmds(EVENT_BUFLEAVE, NULL, NULL, FALSE, curbuf)
|| (bufref_valid(&prevbufref)
&& bufref_valid(&newbufref)