changeset 25885:7c640ad754fb v8.2.3476

patch 8.2.3476: renaming a buffer on startup may cause using freed memory Commit: https://github.com/vim/vim/commit/d3710cf01ef6ab1b2f233866ff01dab76686f642 Author: Bram Moolenaar <Bram@vim.org> Date: Mon Oct 4 23:13:13 2021 +0100 patch 8.2.3476: renaming a buffer on startup may cause using freed memory Problem: Renaming a buffer on startup may cause using freed memory. Solution: Check if the buffer is used in a window. (closes https://github.com/vim/vim/issues/8955)
author Bram Moolenaar <Bram@vim.org>
date Tue, 05 Oct 2021 00:15:04 +0200
parents 25fbd356bb09
children b7490c2bd244
files src/buffer.c src/testdir/test_startup.vim src/version.c
diffstat 3 files changed, 27 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -3399,7 +3399,17 @@ setfname(
 #endif
 	if (obuf != NULL && obuf != buf)
 	{
-	    if (obuf->b_ml.ml_mfp != NULL)	// it's loaded, fail
+	    win_T	*win;
+	    tabpage_T   *tab;
+	    int		in_use = FALSE;
+
+	    // during startup a window may use a buffer that is not loaded yet
+	    FOR_ALL_TAB_WINDOWS(tab, win)
+		if (win->w_buffer == obuf)
+		    in_use = TRUE;
+
+	    // it's loaded or used in a window, fail
+	    if (obuf->b_ml.ml_mfp != NULL || in_use)
 	    {
 		if (message)
 		    emsg(_("E95: Buffer with this name already exists"));
--- a/src/testdir/test_startup.vim
+++ b/src/testdir/test_startup.vim
@@ -1296,4 +1296,18 @@ func Test_echo_true_in_cmd()
   call delete('Xresult')
 endfunc
 
+func Test_rename_buffer_on_startup()
+  let lines =<< trim END
+      call writefile(['done'], 'Xresult')
+      qa!
+  END
+  call writefile(lines, 'Xscript')
+  if RunVim([], [], "--clean -e -s --cmd 'file x|new|file x' --cmd 'so Xscript'")
+    call assert_equal(['done'], readfile('Xresult'))
+  endif
+  call delete('Xscript')
+  call delete('Xresult')
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab
--- a/src/version.c
+++ b/src/version.c
@@ -758,6 +758,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    3476,
+/**/
     3475,
 /**/
     3474,