patch 9.1.0130: [security]: UAF if win_split_ins autocommands delete "wp" Commit: https://github.com/vim/vim/commit/abf7030a5c22257f066fa9c4061ad150d5a82577 Author: Sean Dewar <6256228+seandewar@users.noreply.github.com> Date: Sat Feb 24 10:20:24 2024 +0100 patch 9.1.0130: [security]: UAF if win_split_ins autocommands delete "wp" Problem: heap-use-after-free in win_splitmove if Enter/Leave autocommands from win_split_ins immediately closes "wp". Solution: check that "wp" is valid after win_split_ins. (Sean Dewar) closes: #14078 Signed-off-by: Sean Dewar <6256228+seandewar@users.noreply.github.com> Signed-off-by: Christian Brabandt <cb@256bit.org>

--- a/src/window.c
+++ b/src/window.c
@@ -1954,7 +1954,8 @@ win_splitmove(win_T *wp, int size, int f
     }
 
     // If splitting horizontally, try to preserve height.
-    if (size == 0 && !(flags & WSP_VERT))
+    // Note that win_split_ins autocommands may have immediately closed "wp"!
+    if (size == 0 && !(flags & WSP_VERT) && win_valid(wp))
     {
 	win_setheight_win(height, wp);
 	if (p_ea)