Mercurial > vim
annotate src/proto/evalbuffer.pro @ 33802:b857615e5d42 v9.0.2117
patch 9.0.2117: [security] use-after-free in qf_free_items
Commit: https://github.com/vim/vim/commit/567cae2630a51efddc07eacff3b38a295e1f5671
Author: Christian Brabandt <cb@256bit.org>
Date: Sun Nov 19 16:19:27 2023 +0100
patch 9.0.2117: [security] use-after-free in qf_free_items
Problem: [security] use-after-free in qf_free_items
Solution: only access qfpnext, if it hasn't been freed
Coverity discovered a possible use-after-free in qf_free_items. When
freeing the qfline items, we may access freed memory, when qfp ==
qfpnext.
So only access qfpnext, when it hasn't been freed.
Signed-off-by: Christian Brabandt <cb@256bit.org>
author | Christian Brabandt <cb@256bit.org> |
---|---|
date | Tue, 21 Nov 2023 20:15:05 +0100 |
parents | 7831da568864 |
children |
rev | line source |
---|---|
18010
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
1 /* evalbuffer.c */ |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
2 int set_ref_in_buffers(int copyID); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
3 buf_T *buflist_find_by_name(char_u *name, int curtab_only); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
4 buf_T *find_buffer(typval_T *avar); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
5 void f_append(typval_T *argvars, typval_T *rettv); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
6 void f_appendbufline(typval_T *argvars, typval_T *rettv); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
7 void f_bufadd(typval_T *argvars, typval_T *rettv); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
8 void f_bufexists(typval_T *argvars, typval_T *rettv); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
9 void f_buflisted(typval_T *argvars, typval_T *rettv); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
10 void f_bufload(typval_T *argvars, typval_T *rettv); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
11 void f_bufloaded(typval_T *argvars, typval_T *rettv); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
12 void f_bufname(typval_T *argvars, typval_T *rettv); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
13 void f_bufnr(typval_T *argvars, typval_T *rettv); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
14 void f_bufwinid(typval_T *argvars, typval_T *rettv); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
15 void f_bufwinnr(typval_T *argvars, typval_T *rettv); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
16 void f_deletebufline(typval_T *argvars, typval_T *rettv); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
17 void f_getbufinfo(typval_T *argvars, typval_T *rettv); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
18 void f_getbufline(typval_T *argvars, typval_T *rettv); |
31164
7831da568864
patch 9.0.0916: getbufline() is inefficient for getting a single line
Bram Moolenaar <Bram@vim.org>
parents:
26978
diff
changeset
|
19 void f_getbufoneline(typval_T *argvars, typval_T *rettv); |
18010
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
20 void f_getline(typval_T *argvars, typval_T *rettv); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
21 void f_setbufline(typval_T *argvars, typval_T *rettv); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
22 void f_setline(typval_T *argvars, typval_T *rettv); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
23 void switch_buffer(bufref_T *save_curbuf, buf_T *buf); |
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
24 void restore_buffer(bufref_T *save_curbuf); |
26978
aa613a3084b9
patch 8.2.4018: ml_get error when win_execute redraws with Visual selection
Bram Moolenaar <Bram@vim.org>
parents:
26935
diff
changeset
|
25 void switch_to_win_for_buf(buf_T *buf, switchwin_T *switchwin, bufref_T *save_curbuf); |
aa613a3084b9
patch 8.2.4018: ml_get error when win_execute redraws with Visual selection
Bram Moolenaar <Bram@vim.org>
parents:
26935
diff
changeset
|
26 void restore_win_for_buf(switchwin_T *switchwin, bufref_T *save_curbuf); |
18010
cf8e0c7e0cb9
patch 8.1.2001: some source files are too big
Bram Moolenaar <Bram@vim.org>
parents:
diff
changeset
|
27 /* vim: set ft=c : */ |