zeertzjq 2d5f56c0aa vim-patch:9.2.0461: Corrupted undofile causes use-after-free (#39707) ...

Problem:  The four pointer-resolution loops in u_read_undo() lack
          an i != j guard, so a header whose uh_next.seq equals
          its own uh_seq resolves uh_next.ptr to itself.  On
          buffer close, u_freeheader() sees uhp->uh_next.ptr !=
          NULL and skips updating b_u_oldhead, so u_blockfree()
          dereferences the freed header on the next iteration.
          The same pattern applies to uh_prev, uh_alt_next and
          uh_alt_prev.  A crafted .un~ file in the same directory
          as a text file can trigger the use-after-free and
          subsequent double-free when the buffer is closed.
          (Daniel Cervera)
Solution: Add an i != j guard to each of the four resolution
          loops, matching the guard already present in the
          duplicate-detection loop above.

closes: vim/vim#20168

Supported by AI

4f610f07b7

Co-authored-by: Christian Brabandt <cb@256bit.org>

2026-05-10 08:06:07 +08:00

..

testdir

vim-patch:9.2.0461: Corrupted undofile causes use-after-free (#39707)

2026-05-10 08:06:07 +08:00

memfile_test.c

build: remove PVS

2023-11-12 21:26:39 +01:00