thac0/vim
1
0
Fork 0
forked from aniani/vim
Code Activity

patch 9.1.0130: [security]: UAF if win_split_ins autocommands delete "wp"

Browse Source 
Problem:  heap-use-after-free in win_splitmove if Enter/Leave
          autocommands from win_split_ins immediately closes "wp".
Solution: check that "wp" is valid after win_split_ins.
          (Sean Dewar)

closes: #14078

Signed-off-by: Sean Dewar <6256228+seandewar@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Sean Dewar
2024-02-24 10:20:24 +01:00
committed by Christian Brabandt
parent f548ae7b63
commit abf7030a5c
3 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/window.c
View File

@@ -1954,7 +1954,8 @@ win_splitmove(win_T *wp, int size, int flags)
}
// If splitting horizontally, try to preserve height.
if (size == 0 && !(flags & WSP_VERT))
// Note that win_split_ins autocommands may have immediately closed "wp"!
if (size == 0 && !(flags & WSP_VERT) && win_valid(wp))
{
win_setheight_win(height, wp);
if (p_ea)