Hi,
On Mon, Dec 18, 2017 at 11:54 AM, Yegappan Lakshmanan
<[email protected]> wrote:
> Hi,
>
> On Mon, Dec 18, 2017 at 8:54 AM, Dominique Pellé
> <[email protected]> wrote:
>> afl-fuzz found a case where free memory is used in
>> quickfix and which results in a crash.
>>
>
> Thanks for reporting the crash. I have simplified the test function:
>
> func X()
> call setloclist(0, [], 'a', {'context' : []})
> lopen | only
> call test_garbagecollect_now()
> echo getloclist(0, {'context' : 1}).context
> endfunc
>
> call X()
>
> The code that marks the context as in use is not handling the case
> where a location list is only attached to the location list window
> and not to a regular window. Will try to send a fix later.
>
A fix for this crash and a test is attached.
Regards,
Yegappan
>>
>> It happens with the latest vim-8.0.1404 and older.
>>
>> Steps to reproduce:
>>
>> $ cat use-free-mem-quickfix.vim
>> func X(c)
>> wincmd p
>> call setloclist(0, [])
>> lopen
>> if a:c == 'c'
>> copen|cclose
>> endif
>> call setloclist(0, [], 'a', {'context':[]})
>> call test_garbagecollect_now()
>> call setloclist(0, [], 'f')
>> endfunc
>> call X('c')
>> call X('l')
>>
>> $ ./vim -u NONE -S use-free-mem-quickfix.vim -c qa
>> Vim: Caught deadly signal SEGV
>> Vim: Finished.
>> Segmentation fault (core dumped)
>>
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
diff --git a/src/quickfix.c b/src/quickfix.c
index 70522fa62..c48365eed 100644
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -5447,6 +5447,16 @@ set_ref_in_quickfix(int copyID)
if (abort)
return abort;
}
+ if (IS_LL_WINDOW(win) && (win->w_llist_ref->qf_refcount == 1))
+ {
+ /* In a location list window and none of the other windows is
+ * referring to this location list. Mark the location list
+ * context as still in use.
+ */
+ abort = mark_quickfix_ctx(win->w_llist_ref, copyID);
+ if (abort)
+ return abort;
+ }
}
return abort;
diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
index bda775f3a..3c1f92f02 100644
--- a/src/testdir/test_quickfix.vim
+++ b/src/testdir/test_quickfix.vim
@@ -2939,3 +2939,17 @@ func Test_getqflist()
call Xgetlist_empty_tests('c')
call Xgetlist_empty_tests('l')
endfunc
+
+" The following test used to crash Vim.
+" Open the location list window and close the regular window associated with
+" the location list. When the garbage collection runs now, it incorrectly
+" marks the location list context as not in use and frees the context.
+func Test_ll_window_ctx()
+ call setloclist(0, [], 'f')
+ call setloclist(0, [], 'a', {'context' : []})
+ lopen | only
+ call test_garbagecollect_now()
+ echo getloclist(0, {'context' : 1}).context
+ enew | only
+endfunc
+
