mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-10-05 17:36:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

revert: "memory: Free buffers after freeing variables" (#26356)

Browse Source 
This reverts commit fe30d8ccef.

The original commit intends to prevent heap-use-after-free with EXITFREE
caused by changedtick_di, which is no longer a problem.

Freeing buffers after freeing variables will cause heap-use-after-free
with EXITFREE when a partial is used as prompt callback.
This commit is contained in:
zeertzjq
2023-12-02 09:55:11 +08:00
committed by GitHub
parent fedbf32250
commit 387c5ba3de
3 changed files with 32 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/nvim/drawscreen.c
View File

@@ -2643,7 +2643,6 @@ int number_width(win_T *wp)
/// Set must_redraw only if not already set to a higher value.
/// e.g. if must_redraw is UPD_CLEAR, type UPD_NOT_VALID will do nothing.
void redraw_later(win_T *wp, int type)
FUNC_ATTR_NONNULL_ALL
{
if (!exiting && wp->w_redr_type < type) {
wp->w_redr_type = type;

38
src/nvim/memory.c
View File

@@ -782,6 +782,25 @@ void free_all_mem(void)
// Free all option values. Must come after closing windows.
free_all_options();
// Free all buffers. Reset 'autochdir' to avoid accessing things that
// were freed already.
// Must be after eval_clear to avoid it trying to access b:changedtick after
// freeing it.
p_acd = false;
for (buf = firstbuf; buf != NULL;) {
bufref_T bufref;
set_bufref(&bufref, buf);
nextbuf = buf->b_next;
// Since options (in addition to other stuff) have been freed above we need to ensure no
// callbacks are called, so free them before closing the buffer.
buf_free_callbacks(buf);
close_buffer(NULL, buf, DOBUF_WIPE, false, false);
// Didn't work, try next one.
buf = bufref_valid(&bufref) ? nextbuf : firstbuf;
}
// Clear registers.
clear_registers();
ResetRedobuff();
@@ -807,25 +826,6 @@ void free_all_mem(void)
api_extmark_free_all_mem();
ctx_free_all();
// Free all buffers. Reset 'autochdir' to avoid accessing things that
// were freed already.
// Must be after eval_clear to avoid it trying to access b:changedtick after
// freeing it.
p_acd = false;
for (buf = firstbuf; buf != NULL;) {
bufref_T bufref;
set_bufref(&bufref, buf);
nextbuf = buf->b_next;
// Since options (in addition to other stuff) have been freed above we need to ensure no
// callbacks are called, so free them before closing the buffer.
buf_free_callbacks(buf);
close_buffer(NULL, buf, DOBUF_WIPE, false, false);
// Didn't work, try next one.
buf = bufref_valid(&bufref) ? nextbuf : firstbuf;
}
map_destroy(int, &buffer_handles);
map_destroy(int, &window_handles);
map_destroy(int, &tabpage_handles);