mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-11-04 01:34:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data (#30377)

Browse Source 
Problem:  heap-use-after-free in garbage collection with location list
          user data.
Solution: Mark user data as in use when no other window is referencing
          the location list (zeertzjq)

fixes: neovim/neovim#30371
closes: vim/vim#15683

be4bd189d2
This commit is contained in:
zeertzjq
2024-09-14 19:38:33 +08:00
committed by GitHub
parent f2173b1aa2
commit 325d349f9d
2 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/nvim/quickfix.c
View File

@@ -6875,7 +6875,8 @@ bool set_ref_in_quickfix(int copyID)
// In a location list window and none of the other windows is
// referring to this location list. Mark the location list
// context as still in use.
if (mark_quickfix_ctx(win->w_llist_ref, copyID)) {
if (mark_quickfix_ctx(win->w_llist_ref, copyID)
|| mark_quickfix_user_data(win->w_llist_ref, copyID)) {
return true;
}
}

14
test/old/testdir/test_quickfix.vim
View File

@@ -4071,11 +4071,23 @@ func Test_ll_window_ctx()
enew | only
endfunc
" Similar to the problem above, but for user data.
func Test_ll_window_user_data()
call setloclist(0, [#{bufnr: bufnr(), user_data: {}}])
lopen
wincmd t
close
call test_garbagecollect_now()
call feedkeys("\<CR>", 'tx')
call test_garbagecollect_now()
%bwipe!
endfunc
" The following test used to crash vim
func Test_lfile_crash()
sp Xtest
au QuickFixCmdPre * bw
call assert_fails('lfile', 'E40')
call assert_fails('lfile', 'E40:')
au! QuickFixCmdPre
endfunc