mirror of
https://github.com/neovim/neovim.git
synced 2026-07-17 06:31:16 +00:00
fix(window): win_move_after UAF from naughty autocmds (#37065)
Problem: use-after-free in win_move_after if win_enter autocommands free win1/2. Solution: set w_pos_changed before calling win_enter.
This commit is contained in:
@@ -715,4 +715,20 @@ describe('autocmd', function()
|
||||
vim.cmd "tabnew"
|
||||
]]
|
||||
end)
|
||||
|
||||
it('no use-after-free from win_enter autocommands in win_move_after', function()
|
||||
exec [[
|
||||
split foo
|
||||
split bar
|
||||
lcd ..
|
||||
wincmd b
|
||||
]]
|
||||
eq(fn.winnr('$'), fn.winnr())
|
||||
-- Using DirChanged as Enter/Leave autocmds are blocked by :ball here.
|
||||
exec [[
|
||||
autocmd DirChanged * ++once split flarb | only!
|
||||
ball
|
||||
]]
|
||||
eq('flarb', fn.bufname())
|
||||
end)
|
||||
end)
|
||||
|
||||
Reference in New Issue
Block a user