mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-11-16 23:31:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.1.1387: memory leak when buflist_new() fails to reuse curbuf

Browse Source 
Problem:  buflist_new() leaks ffname and fails to reuse curbuf when
          autocommands from buf_freeall change curbuf. Plus, a new
          buffer is not allocated in this case, despite what the comment
          above claims.
Solution: Remove the condition so ffname is not leaked and so a new
          buffer is allocated like before v8.2.4791. It should not be
          possible for undo_ftplugin or buf_freeall autocommands to
          delete the buffer as they set b_locked, but to stay consistent
          with other uses of buf_freeall, guard against that anyway
          (Sean Dewar).

Note that buf is set to NULL if it was deleted to guard against the (rare)
possibility of messing up the "buf != curbuf" condition below if a new buffer
happens to be allocated at the same address.

closes: vim/vim#17319

0077282c82

Co-authored-by: Sean Dewar <6256228+seandewar@users.noreply.github.com>
This commit is contained in:
Sean Dewar
2025-05-14 19:39:13 +01:00
parent f2aec4bc05
commit 6b9665a507
2 changed files with 31 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/nvim/buffer.c
View File

@@ -1904,18 +1904,21 @@ buf_T *buflist_new(char *ffname_arg, char *sfname_arg, linenr_T lnum, int flags)
// buffer.)
buf = NULL;
if ((flags & BLN_CURBUF) && curbuf_reusable()) {
bufref_T bufref;
assert(curbuf != NULL);
buf = curbuf;
set_bufref(&bufref, buf);
// It's like this buffer is deleted. Watch out for autocommands that
// change curbuf! If that happens, allocate a new buffer anyway.
buf_freeall(buf, BFA_WIPE | BFA_DEL);
if (buf != curbuf) { // autocommands deleted the buffer!
return NULL;
}
if (aborting()) { // autocmds may abort script processing
xfree(ffname);
return NULL;
}
if (!bufref_valid(&bufref)) {
buf = NULL; // buf was deleted; allocate a new buffer
}
}
if (buf != curbuf || curbuf == NULL) {
buf = xcalloc(1, sizeof(buf_T));