Mercurial > vim
diff src/buffer.c @ 23869:5a4f9c5c1b99 v8.2.2476
patch 8.2.2476: using freed memory when splitting window while closing buffer
Commit: https://github.com/vim/vim/commit/983d83ff1cd796ff321074335fa53fbe7ac45a46
Author: Bram Moolenaar <Bram@vim.org>
Date: Sun Feb 7 12:12:43 2021 +0100
patch 8.2.2476: using freed memory when splitting window while closing buffer
Problem: Using freed memory when using an autocommand to split a window
while a buffer is being closed.
Solution: Disallow splitting when the buffer has b_locked_split set.
| author | Bram Moolenaar <Bram@vim.org> |
|---|---|
| date | Sun, 07 Feb 2021 12:15:03 +0100 |
| parents | 29eccef07e2f |
| children | 44be09b25619 |
line wrap: on
line diff
--- a/src/buffer.c +++ b/src/buffer.c @@ -595,6 +595,7 @@ close_buffer( if (buf->b_nwindows == 1) { ++buf->b_locked; + ++buf->b_locked_split; if (apply_autocmds(EVENT_BUFWINLEAVE, buf->b_fname, buf->b_fname, FALSE, buf) && !bufref_valid(&bufref)) @@ -605,6 +606,7 @@ aucmd_abort: return FALSE; } --buf->b_locked; + --buf->b_locked_split; if (abort_if_last && one_window()) // Autocommands made this the only window. goto aucmd_abort; @@ -614,12 +616,14 @@ aucmd_abort: if (!unload_buf) { ++buf->b_locked; + ++buf->b_locked_split; if (apply_autocmds(EVENT_BUFHIDDEN, buf->b_fname, buf->b_fname, FALSE, buf) && !bufref_valid(&bufref)) // Autocommands deleted the buffer. goto aucmd_abort; --buf->b_locked; + --buf->b_locked_split; if (abort_if_last && one_window()) // Autocommands made this the only window. goto aucmd_abort; @@ -800,6 +804,7 @@ buf_freeall(buf_T *buf, int flags) // Make sure the buffer isn't closed by autocommands. ++buf->b_locked; + ++buf->b_locked_split; set_bufref(&bufref, buf); if (buf->b_ml.ml_mfp != NULL) { @@ -826,6 +831,7 @@ buf_freeall(buf_T *buf, int flags) return; } --buf->b_locked; + --buf->b_locked_split; // If the buffer was in curwin and the window has changed, go back to that // window, if it still exists. This avoids that ":edit x" triggering a @@ -1718,8 +1724,8 @@ set_curbuf(buf_T *buf, int action) set_bufref(&prevbufref, prevbuf); set_bufref(&newbufref, buf); - // Autocommands may delete the current buffer and/or the buffer we want to go - // to. In those cases don't close the buffer. + // Autocommands may delete the current buffer and/or the buffer we want to + // go to. In those cases don't close the buffer. if (!apply_autocmds(EVENT_BUFLEAVE, NULL, NULL, FALSE, curbuf) || (bufref_valid(&prevbufref) && bufref_valid(&newbufref)