Mercurial > vim

comparison src/window.c @ 34414:e0d4ce8ebf12 v9.1.0130

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
patch 9.1.0130: [security]: UAF if win_split_ins autocommands delete "wp" Commit: https://github.com/vim/vim/commit/abf7030a5c22257f066fa9c4061ad150d5a82577 Author: Sean Dewar <6256228+seandewar@users.noreply.github.com> Date: Sat Feb 24 10:20:24 2024 +0100 patch 9.1.0130: [security]: UAF if win_split_ins autocommands delete "wp" Problem: heap-use-after-free in win_splitmove if Enter/Leave autocommands from win_split_ins immediately closes "wp". Solution: check that "wp" is valid after win_split_ins. (Sean Dewar) closes: #14078 Signed-off-by: Sean Dewar <6256228+seandewar@users.noreply.github.com> Signed-off-by: Christian Brabandt <cb@256bit.org>
author Christian Brabandt <cb@256bit.org>
date Sat, 24 Feb 2024 10:30:07 +0100
parents 8b0e390b61fe
children f8fed6c8bb60
comparison
equal deleted inserted replaced
34413:7c13c892deab 34414:e0d4ce8ebf12
1952 (void)win_comp_pos(); // recompute window positions 1952 (void)win_comp_pos(); // recompute window positions
1953 return FAIL; 1953 return FAIL;
1954 } 1954 }
1955 1955
1956 // If splitting horizontally, try to preserve height. 1956 // If splitting horizontally, try to preserve height.
1957 if (size == 0 && !(flags & WSP_VERT)) 1957 // Note that win_split_ins autocommands may have immediately closed "wp"!
1958 if (size == 0 && !(flags & WSP_VERT) && win_valid(wp))
1958 { 1959 {
1959 win_setheight_win(height, wp); 1960 win_setheight_win(height, wp);
1960 if (p_ea) 1961 if (p_ea)
1961 { 1962 {
1962 // Equalize windows. Note that win_split_ins autocommands may have 1963 // Equalize windows. Note that win_split_ins autocommands may have