Mercurial > vim
changeset 30389:14c0d0c72bcd v9.0.0530
patch 9.0.0530: using freed memory when autocmd changes mark
Commit: https://github.com/vim/vim/commit/8ecfa2c56b4992c7f067b92488aa9acea5a454ad
Author: Bram Moolenaar <Bram@vim.org>
Date: Wed Sep 21 13:07:22 2022 +0100
patch 9.0.0530: using freed memory when autocmd changes mark
Problem: Using freed memory when autocmd changes mark.
Solution: Copy the mark before editing another buffer.
| author | Bram Moolenaar <Bram@vim.org> |
|---|---|
| date | Wed, 21 Sep 2022 14:15:03 +0200 |
| parents | 62c76fa18201 |
| children | e8452d826869 |
| files | src/mark.c src/testdir/test_marks.vim src/version.c |
| diffstat | 3 files changed, 22 insertions(+), 5 deletions(-) [+] |
line wrap: on
line diff
--- a/src/mark.c +++ b/src/mark.c @@ -221,17 +221,19 @@ movemark(int count) fname2fnum(jmp); if (jmp->fmark.fnum != curbuf->b_fnum) { - // jump to other file - if (buflist_findnr(jmp->fmark.fnum) == NULL) + // Make a copy, an autocommand may make "jmp" invalid. + fmark_T fmark = jmp->fmark; + + // jump to the file with the mark + if (buflist_findnr(fmark.fnum) == NULL) { // Skip this one .. count += count < 0 ? -1 : 1; continue; } - if (buflist_getfile(jmp->fmark.fnum, jmp->fmark.mark.lnum, - 0, FALSE) == FAIL) + if (buflist_getfile(fmark.fnum, fmark.mark.lnum, 0, FALSE) == FAIL) return (pos_T *)NULL; // Set lnum again, autocommands my have changed it - curwin->w_cursor = jmp->fmark.mark; + curwin->w_cursor = fmark.mark; pos = (pos_T *)-1; } else
--- a/src/testdir/test_marks.vim +++ b/src/testdir/test_marks.vim @@ -305,4 +305,17 @@ func Test_getmarklist() close! endfunc +" This was using freed memory +func Test_jump_mark_autocmd() + next 00 + edit 0 + sargument + au BufEnter 0 all + sil norm + + au! BufEnter + bwipe! +endfunc + + " vim: shiftwidth=2 sts=2 expandtab