patch 9.1.0130: [security]: UAF if win_split_ins autocommands delete "wp"
Commit: https://github.com/vim/vim/commit/abf7030a5c22257f066fa9c4061ad150d5a82577 Author: Sean Dewar <6256228+seande...@users.noreply.github.com> Date: Sat Feb 24 10:20:24 2024 +0100 patch 9.1.0130: [security]: UAF if win_split_ins autocommands delete "wp" Problem: heap-use-after-free in win_splitmove if Enter/Leave autocommands from win_split_ins immediately closes "wp". Solution: check that "wp" is valid after win_split_ins. (Sean Dewar) closes: #14078 Signed-off-by: Sean Dewar <6256228+seande...@users.noreply.github.com> Signed-off-by: Christian Brabandt <c...@256bit.org> diff --git a/src/testdir/test_window_cmd.vim b/src/testdir/test_window_cmd.vim index a70fb790c..917c43203 100644 --- a/src/testdir/test_window_cmd.vim +++ b/src/testdir/test_window_cmd.vim @@ -1191,6 +1191,15 @@ func Test_win_splitmove() call assert_equal(v:true, s:triggered) unlet! s:triggered + split + let close_win = winnr('#') + augroup WinSplitMove + au! + au WinEnter * ++once quit! + augroup END + call win_splitmove(close_win, winnr()) + call assert_equal(0, win_id2win(close_win)) + au! WinSplitMove augroup! WinSplitMove %bw! diff --git a/src/version.c b/src/version.c index 3ea94ee92..b6e25e665 100644 --- a/src/version.c +++ b/src/version.c @@ -704,6 +704,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 130, /**/ 129, /**/ diff --git a/src/window.c b/src/window.c index 66a1d7de4..7123780c5 100644 --- a/src/window.c +++ b/src/window.c @@ -1954,7 +1954,8 @@ win_splitmove(win_T *wp, int size, int flags) } // If splitting horizontally, try to preserve height. - if (size == 0 && !(flags & WSP_VERT)) + // Note that win_split_ins autocommands may have immediately closed "wp"! + if (size == 0 && !(flags & WSP_VERT) && win_valid(wp)) { win_setheight_win(height, wp); if (p_ea) -- -- You received this message from the "vim_dev" maillist. Do not top-post! Type your reply below the text you are replying to. For more information, visit http://www.vim.org/maillist.php --- You received this message because you are subscribed to the Google Groups "vim_dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to vim_dev+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/vim_dev/E1rdoMB-00G4QK-7M%40256bit.org.
