From 5de6537c420e8d2af6b19aba0fcac253c9cbe92f Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Sat, 29 Aug 2026 08:33:38 +0800 Subject: [PATCH] vim-patch:9.2.1017: heap-use-after-free in ml_open_file() (#41533) Problem: A SwapExists autocmd can re-open the buffer being edited, causing ml_close() to free the memfile that ml_open_file() still holds a local pointer to, causing use-after-free. Solution: After findswapname() returns, verify that buf->b_ml.ml_mfp is still the same as the copy mfp we hold. closes: vim/vim#21171 https://github.com/vim/vim/commit/7aecb2cca89cfd61741c0b2a3cf8cdac2ebf5e29 Co-authored-by: Christian Brabandt --- src/nvim/memline.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/nvim/memline.c b/src/nvim/memline.c index f7f272f8dd..a0900faeab 100644 --- a/src/nvim/memline.c +++ b/src/nvim/memline.c @@ -510,6 +510,11 @@ void ml_open_file(buf_T *buf) // and creating it, another Vim creates the file. In that case the // creation will fail and we will use another directory. char *fname = findswapname(buf, &dirp, NULL, &found_existing_dir); + // autocmd may have freed mfp, grr! + if (buf->b_ml.ml_mfp != mfp) { + xfree(fname); + return; + } if (dirp == NULL) { break; // out of memory }