mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2026-03-30 20:32:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(messages): allocate message history kind string #38292

Browse Source 
Problem:  nvim_echo()->kind memory may be used after it is freed with :messages.
Solution: Copy and free message kind string in message history.
This commit is contained in:
luukvbaal
2026-03-14 13:07:55 +01:00
committed by GitHub
parent 929be7ee00
commit 83037cf218
3 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
test/functional/api/vim_spec.lua
View File

@@ -3887,6 +3887,15 @@ describe('API', function()
eq(4, api.nvim_echo({ { 'foo' } }, false, { id = 4 }))
eq(5, api.nvim_echo({ { 'foo' } }, false, {}))
end)
it('no use-after-free for custom kind with :messages #38289', function()
exec_lua(function()
vim.api.nvim_echo({ { 'a' } }, true, { kind = 'foo' })
vim.o.guicursor = '' -- pending mode update go brrr
vim.api.nvim__redraw({ flush = true }) -- ui_flush -> arena_mem_free go brrr
vim.cmd.messages()
end)
end)
end)
describe('nvim_open_term', function()