mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-11-16 23:31:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.1.1361: [security]: possible use-after-free when closing a buffer (#33820)

Browse Source 
Problem:  [security]: Possible to open more windows into a closing
          buffer without splitting, bypassing existing "b_locked_split"
          checks and triggering use-after-free
Solution: Disallow switching to a closing buffer. Editing a closing
          buffer (via ":edit", etc.) was fixed in v9.1.0764, but add an
          error message and check just "b_locked_split", as "b_locked"
          is necessary only when the buffer shouldn't be wiped, and may
          be set for buffers that are in-use but not actually closing.
          (Sean Dewar)

closes: vim/vim#17246

6cb1c82840
This commit is contained in:
Sean Dewar
2025-05-04 03:15:51 +01:00
committed by GitHub
parent 2c1f5a6aa5
commit 627c648252
7 changed files with 56 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/nvim/buffer.c
View File

@@ -480,11 +480,6 @@ static bool can_unload_buffer(buf_T *buf)
return can_unload;
}
bool buf_locked(buf_T *buf)
{
return buf->b_locked || buf->b_locked_split;
}
/// Close the link to a buffer.
///
/// @param win If not NULL, set b_last_cursor.
@@ -1300,11 +1295,17 @@ static int do_buffer_ext(int action, int start, int dir, int count, int flags)
return FAIL;
}
if (action == DOBUF_GOTO
&& buf != curbuf
&& !check_can_set_curbuf_forceit((flags & DOBUF_FORCEIT) ? true : false)) {
// disallow navigating to another buffer when 'winfixbuf' is applied
return FAIL;
if (action == DOBUF_GOTO && buf != curbuf) {
if (!check_can_set_curbuf_forceit((flags & DOBUF_FORCEIT) != 0)) {
// disallow navigating to another buffer when 'winfixbuf' is applied
return FAIL;
}
if (buf->b_locked_split) {
// disallow navigating to a closing buffer, which like splitting,
// can result in more windows displaying it
emsg(_(e_cannot_switch_to_a_closing_buffer));
return FAIL;
}
}
if ((action == DOBUF_GOTO || action == DOBUF_SPLIT) && (buf->b_flags & BF_DUMMY)) {