mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-09-29 14:38:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.0.0490: using freed memory with cmdwin and BufEnter autocmd

Browse Source 
Problem:    Using freed memory with cmdwin and BufEnter autocmd.
Solution:   Make sure pointer to b_p_iminsert is still valid.

1c3dd8ddcb

Co-authored-by: Bram Moolenaar <Bram@vim.org>
This commit is contained in:
zeertzjq
2023-05-13 22:29:07 +08:00
parent f80cf0f84f
commit 7eea6b12f9
2 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/nvim/ex_getln.c
View File

@@ -127,6 +127,7 @@ typedef struct command_line_state {
int break_ctrl_c; int break_ctrl_c;
expand_T xpc; expand_T xpc;
long *b_im_ptr; long *b_im_ptr;
buf_T *b_im_ptr_buf; ///< buffer where b_im_ptr is valid
} CommandLineState; } CommandLineState;
typedef struct cmdpreview_win_info { typedef struct cmdpreview_win_info {
@@ -736,7 +737,7 @@ static uint8_t *command_line_enter(int firstc, long count, int indent, bool clea
} else { } else {
s->b_im_ptr = &curbuf->b_p_imsearch; s->b_im_ptr = &curbuf->b_p_imsearch;
} }
s->b_im_ptr_buf = curbuf;
if (*s->b_im_ptr == B_IMODE_LMAP) { if (*s->b_im_ptr == B_IMODE_LMAP) {
State |= MODE_LANGMAP; State |= MODE_LANGMAP;
} }
@@ -1538,20 +1539,21 @@ static int command_line_erase_chars(CommandLineState *s)
/// language :lmap mappings and/or Input Method. /// language :lmap mappings and/or Input Method.
static void command_line_toggle_langmap(CommandLineState *s) static void command_line_toggle_langmap(CommandLineState *s)
{ {
long *b_im_ptr = buf_valid(s->b_im_ptr_buf) ? s->b_im_ptr : NULL;
if (map_to_exists_mode("", MODE_LANGMAP, false)) { if (map_to_exists_mode("", MODE_LANGMAP, false)) {
// ":lmap" mappings exists, toggle use of mappings. // ":lmap" mappings exists, toggle use of mappings.
State ^= MODE_LANGMAP; State ^= MODE_LANGMAP;
if (s->b_im_ptr != NULL) { if (b_im_ptr != NULL) {
if (State & MODE_LANGMAP) { if (State & MODE_LANGMAP) {
*s->b_im_ptr = B_IMODE_LMAP; *b_im_ptr = B_IMODE_LMAP;
} else { } else {
*s->b_im_ptr = B_IMODE_NONE; *b_im_ptr = B_IMODE_NONE;
} }
} }
} }
if (s->b_im_ptr != NULL) { if (b_im_ptr != NULL) {
if (s->b_im_ptr == &curbuf->b_p_iminsert) { if (b_im_ptr == &curbuf->b_p_iminsert) {
set_iminsert_global(curbuf); set_iminsert_global(curbuf);
} else { } else {
set_imsearch_global(curbuf); set_imsearch_global(curbuf);

10
test/old/testdir/test_cmdwin.vim
View File

@@ -28,5 +28,15 @@ func Test_normal_escape()
call assert_equal('" bar', @:) call assert_equal('" bar', @:)
endfunc endfunc
" This was using a pointer to a freed buffer
func Test_cmdwin_freed_buffer_ptr()
au BufEnter * next 0| file
edit 0
silent! norm q/
au! BufEnter
bwipe!
endfunc
" vim: shiftwidth=2 sts=2 expandtab " vim: shiftwidth=2 sts=2 expandtab