From 832bc5c169d8b339ef139ef0bdcefb2e72864e6e Mon Sep 17 00:00:00 2001
From: Sean Dewar <6256228+seandewar@users.noreply.github.com>
Date: Sun, 25 Feb 2024 01:30:37 +0000
Subject: [PATCH] vim-patch:9.1.0130: [security]: UAF if win_split_ins
 autocommands delete "wp"

Problem:  heap-use-after-free in win_splitmove if Enter/Leave
          autocommands from win_split_ins immediately closes "wp".
Solution: check that "wp" is valid after win_split_ins.
          (Sean Dewar)

https://github.com/vim/vim/commit/abf7030a5c22257f066fa9c4061ad150d5a82577
---
 src/nvim/window.c                    | 4 ++--
 test/old/testdir/test_window_cmd.vim | 9 +++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/src/nvim/window.c b/src/nvim/window.c
index 2d0010ad6c..80cb9ab6a0 100644
--- a/src/nvim/window.c
+++ b/src/nvim/window.c
@@ -1948,8 +1948,8 @@ int win_splitmove(win_T *wp, int size, int flags)
   }
 
   // If splitting horizontally, try to preserve height.
-  // Note that win_split_ins autocommands may have immediately made "wp" floating!
-  if (size == 0 && !(flags & WSP_VERT) && !wp->w_floating) {
+  // Note that win_split_ins autocommands may have immediately closed "wp", or made it floating!
+  if (size == 0 && !(flags & WSP_VERT) && win_valid(wp) && !wp->w_floating) {
     win_setheight_win(height, wp);
     if (p_ea) {
       // Equalize windows.  Note that win_split_ins autocommands may have
diff --git a/test/old/testdir/test_window_cmd.vim b/test/old/testdir/test_window_cmd.vim
index 7ea556b11f..e6d591f8c9 100644
--- a/test/old/testdir/test_window_cmd.vim
+++ b/test/old/testdir/test_window_cmd.vim
@@ -1150,6 +1150,15 @@ func Test_win_splitmove()
   call assert_equal(v:true, s:triggered)
   unlet! s:triggered
 
+  split
+  let close_win = winnr('#')
+  augroup WinSplitMove
+    au!
+    au WinEnter * ++once quit!
+  augroup END
+  call win_splitmove(close_win, winnr())
+  call assert_equal(0, win_id2win(close_win))
+
   au! WinSplitMove
   augroup! WinSplitMove
   %bw!