mirror of
https://github.com/neovim/neovim.git
synced 2026-02-11 14:28:48 +00:00
Problem : Use after free @ 1795.
Diagnostic : Real issue.
Rationale : prev_curtab can in fact be freed as a result of call
`win_close_othertab(win, free_buf, prev_curtab);`, but it's
later used at
`sprintf(..., tabpage_index(prev_curtab));`.
This was introduced at
3ffc5d81c3.
Resolution : Move prev_idx calculation before the call freeing
prev_curtab.