mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-10-04 17:06:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.1.0130: [security]: UAF if win_split_ins autocommands delete "wp"

Browse Source 
Problem:  heap-use-after-free in win_splitmove if Enter/Leave
          autocommands from win_split_ins immediately closes "wp".
Solution: check that "wp" is valid after win_split_ins.
          (Sean Dewar)

abf7030a5c
This commit is contained in:
Sean Dewar
2024-02-25 01:30:37 +00:00
parent e3d4dfb6c3
commit 832bc5c169
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/nvim/window.c
View File

@@ -1948,8 +1948,8 @@ int win_splitmove(win_T *wp, int size, int flags)
} }
// If splitting horizontally, try to preserve height. // If splitting horizontally, try to preserve height.
// Note that win_split_ins autocommands may have immediately made "wp" floating! // Note that win_split_ins autocommands may have immediately closed "wp", or made it floating!
if (size == 0 && !(flags & WSP_VERT) && !wp->w_floating) { if (size == 0 && !(flags & WSP_VERT) && win_valid(wp) && !wp->w_floating) {
win_setheight_win(height, wp); win_setheight_win(height, wp);
if (p_ea) { if (p_ea) {
// Equalize windows. Note that win_split_ins autocommands may have // Equalize windows. Note that win_split_ins autocommands may have

9
test/old/testdir/test_window_cmd.vim
View File

@@ -1150,6 +1150,15 @@ func Test_win_splitmove()
call assert_equal(v:true, s:triggered) call assert_equal(v:true, s:triggered)
unlet! s:triggered unlet! s:triggered
split
let close_win = winnr('#')
augroup WinSplitMove
au!
au WinEnter * ++once quit!
augroup END
call win_splitmove(close_win, winnr())
call assert_equal(0, win_id2win(close_win))
au! WinSplitMove au! WinSplitMove
augroup! WinSplitMove augroup! WinSplitMove
%bw! %bw!