mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-09-29 06:28:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.0.2010: [security] use-after-free from buf_contents_changed()

Browse Source 
Problem:  [security] use-after-free from buf_contents_changed()
Solution: block autocommands

41e6f7d6ba

Co-authored-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
zeertzjq
2023-11-17 09:42:59 +08:00
parent b6200fbdf2
commit d49be1cd28
3 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/nvim/buffer.c
View File

@@ -4223,6 +4223,10 @@ bool buf_contents_changed(buf_T *buf)
aco_save_T aco; aco_save_T aco;
aucmd_prepbuf(&aco, newbuf); aucmd_prepbuf(&aco, newbuf);
// We don't want to trigger autocommands now, they may have nasty
// side-effects like wiping buffers
block_autocmds();
if (ml_open(curbuf) == OK if (ml_open(curbuf) == OK
&& readfile(buf->b_ffname, buf->b_fname, && readfile(buf->b_ffname, buf->b_fname,
0, 0, (linenr_T)MAXLNUM, 0, 0, (linenr_T)MAXLNUM,
@@ -4247,6 +4251,8 @@ bool buf_contents_changed(buf_T *buf)
wipe_buffer(newbuf, false); wipe_buffer(newbuf, false);
} }
unblock_autocmds();
return differ; return differ;
} }

BIN
test/old/testdir/crash/editing_arg_idx_POC_1 Normal file
View File

Binary file not shown.

9
test/old/testdir/test_crash.vim
View File

@@ -78,6 +78,14 @@ func Test_crash1()
\ ' && echo "crash 9: [OK]" >> X_crash1_result.txt' .. "\<cr>") \ ' && echo "crash 9: [OK]" >> X_crash1_result.txt' .. "\<cr>")
call TermWait(buf, 1000) call TermWait(buf, 1000)
let file = 'crash/editing_arg_idx_POC_1'
let args = printf(cmn_args, vim, file)
call term_sendkeys(buf, args ..
\ ' || echo "crash 10: [OK]" >> X_crash1_result.txt' .. "\<cr>")
call TermWait(buf, 1000)
call delete('Xerr')
call delete('@')
" clean up " clean up
exe buf .. "bw!" exe buf .. "bw!"
@@ -93,6 +101,7 @@ func Test_crash1()
\ 'crash 7: [OK]', \ 'crash 7: [OK]',
\ 'crash 8: [OK]', \ 'crash 8: [OK]',
\ 'crash 9: [OK]', \ 'crash 9: [OK]',
\ 'crash 10: [OK]',
\ ] \ ]
call assert_equal(expected, getline(1, '$')) call assert_equal(expected, getline(1, '$'))