vim-patch:8.2.4281: using freed memory with :lopen and :bwipe

Problem:    Using freed memory with :lopen and :bwipe.
Solution:   Do not use a wiped out buffer.
9b4a80a665

Cherry-pick some indent changes from patch 8.2.1432.
This commit is contained in:
zeertzjq
2022-03-24 12:29:26 +08:00
parent 9530c2d6d8
commit 19bbc43947
2 changed files with 106 additions and 82 deletions

View File

@@ -1486,8 +1486,15 @@ void set_curbuf(buf_T *buf, int action)
// An autocommand may have deleted "buf", already entered it (e.g., when // An autocommand may have deleted "buf", already entered it (e.g., when
// it did ":bunload") or aborted the script processing! // it did ":bunload") or aborted the script processing!
// If curwin->w_buffer is null, enter_buffer() will make it valid again // If curwin->w_buffer is null, enter_buffer() will make it valid again
if ((buf_valid(buf) && buf != curbuf && !aborting()) || curwin->w_buffer == NULL) { bool valid = buf_valid(buf);
if ((valid && buf != curbuf && !aborting()) || curwin->w_buffer == NULL) {
// If the buffer is not valid but curwin->w_buffer is NULL we must
// enter some buffer. Using the last one is hopefully OK.
if (!valid) {
enter_buffer(lastbuf);
} else {
enter_buffer(buf); enter_buffer(buf);
}
if (old_tw != curbuf->b_p_tw) { if (old_tw != curbuf->b_p_tw) {
check_colorcolumn(curwin); check_colorcolumn(curwin);
} }

View File

@@ -891,6 +891,7 @@ func Test_locationlist_curwin_was_closed()
call assert_fails('lrewind', 'E924:') call assert_fails('lrewind', 'E924:')
augroup! testgroup augroup! testgroup
delfunc R
endfunc endfunc
func Test_locationlist_cross_tab_jump() func Test_locationlist_cross_tab_jump()
@@ -5489,4 +5490,20 @@ func Test_two_qf_windows()
%bw! %bw!
endfunc endfunc
" Weird sequence of commands that caused entering a wiped-out buffer
func Test_lopen_bwipe()
func R()
silent! tab lopen
e x
silent! lfile
endfunc
cal R()
cal R()
cal R()
bw!
delfunc R
endfunc
" vim: shiftwidth=2 sts=2 expandtab " vim: shiftwidth=2 sts=2 expandtab