mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-10-04 08:56:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.1.0130: [security]: UAF if win_split_ins autocommands delete "wp"

Browse Source 
Problem:  heap-use-after-free in win_splitmove if Enter/Leave
          autocommands from win_split_ins immediately closes "wp".
Solution: check that "wp" is valid after win_split_ins.
          (Sean Dewar)

abf7030a5c
This commit is contained in:
Sean Dewar
2024-02-25 01:30:37 +00:00
parent e3d4dfb6c3
commit 832bc5c169
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/nvim/window.c
View File

@@ -1948,8 +1948,8 @@ int win_splitmove(win_T *wp, int size, int flags)
}
// If splitting horizontally, try to preserve height.
// Note that win_split_ins autocommands may have immediately made "wp" floating!
if (size == 0 && !(flags & WSP_VERT) && !wp->w_floating) {
// Note that win_split_ins autocommands may have immediately closed "wp", or made it floating!
if (size == 0 && !(flags & WSP_VERT) && win_valid(wp) && !wp->w_floating) {
win_setheight_win(height, wp);
if (p_ea) {
// Equalize windows. Note that win_split_ins autocommands may have