thac0/vim
1
0
Fork 0
forked from aniani/vim
Code

patch 9.0.1859: heap-use-after-free in bt_normal()

Browse Source 
Problem:  heap-use-after-free in bt_normal()
Solution: check that buffer is still valid

Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Christian Brabandt 2023-09-03 21:43:46 +02:00
parent ee9166eb3b
commit 6e60cf444a
No known key found for this signature in database
GPG Key ID: F3F92DA383FDDE09
4 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/buffer.c
View File

@ -5777,7 +5777,7 @@ bt_normal(buf_T *buf)
bt_quickfix(buf_T *buf UNUSED)
{
#ifdef FEAT_QUICKFIX
return buf != NULL && buf->b_p_bt[0] == 'q';
return buf != NULL && buf_valid(buf) && buf->b_p_bt[0] == 'q';
#else
return FALSE;
#endif

5
src/testdir/crash/bt_quickfix1_poc Normal file
View File

@ -0,0 +1,5 @@
au BufReadPre * exe 'sn' .. expand("<abuf>")
call writefile([''],'X')
sil! e X
call writefile([''],'X')
sil! e X

10
src/testdir/test_crash.vim
View File

@ -49,6 +49,15 @@ func Test_crash1()
call TermWait(buf, 100)
let file = 'crash/bt_quickfix1_poc'
let args = printf(cmn_args, vim, file)
call term_sendkeys(buf, args ..
\ ' && echo "crash 6: [OK]" >> X_crash1_result.txt' .. "\<cr>")
" clean up
call delete('X')
" This test takes a bit longer
call TermWait(buf, 200)
" clean up
exe buf .. "bw!"
@ -60,6 +69,7 @@ func Test_crash1()
\ 'crash 3: [OK]',
\ 'crash 4: [OK]',
\ 'crash 5: [OK]',
\ 'crash 6: [OK]',
\ ]
call assert_equal(expected, getline(1, '$'))

2
src/version.c
View File

@ -699,6 +699,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
1859,
/**/
1858,
/**/