fix(window): win_move_after UAF from naughty autocmds (#37065)

Problem: use-after-free in win_move_after if win_enter autocommands free win1/2.
Solution: set w_pos_changed before calling win_enter.
This commit is contained in:
Sean Dewar
2025-12-21 20:31:05 +00:00
committed by GitHub
parent a2b9720939
commit d1189ea508
2 changed files with 18 additions and 2 deletions

View File

@@ -715,4 +715,20 @@ describe('autocmd', function()
vim.cmd "tabnew"
]]
end)
it('no use-after-free from win_enter autocommands in win_move_after', function()
exec [[
split foo
split bar
lcd ..
wincmd b
]]
eq(fn.winnr('$'), fn.winnr())
-- Using DirChanged as Enter/Leave autocmds are blocked by :ball here.
exec [[
autocmd DirChanged * ++once split flarb | only!
ball
]]
eq('flarb', fn.bufname())
end)
end)