patch 9.1.0143: [security]: autocmd causes use-after-free in set_curbuf() Commit: https://github.com/vim/vim/commit/55f8bba73be5f9c3a5a4d0d6c5f56e65f2c7d3fc Author: Christian Brabandt <cb@256bit.org> Date: Wed Feb 28 23:32:00 2024 +0100 patch 9.1.0143: [security]: autocmd causes use-after-free in set_curbuf() Problem: [security]: autocmd cause use-after-free in set_curbuf() (kawarimidoll) Solution: check side-effect of BufLeave autocommand, when the number of windows changed, close windows containing buffers that will be wiped, if curbuf changed unexpectedly make sure b_nwindows is decremented otherwise it cannot be wiped set_curbuf() already makes some efforts to ensure the BufLeave autocommands do not cause issues. However there are still 2 issues that are not taken care of: 1) If a BufLeave autocommand opens a new window containing the same buffer as that is going got be closed in close_buffer() a bit later, we suddenly have another window open, containing a free'd buffer. So we must check if the number of windows changed and if it does (and the current buffer is going to be wiped (according to the 'bufhidden' setting), let's immediately close all windows containing the current buffer using close_windows() 2) If a BufLeave autocommand changes our current buffer (displays it in the current window), buf->b_nwindow will be incremented. As part of set_curbuf() we will however enter another buffer soon, which means, the newly created curbuf will have b_nwindows still have set, even so the buffer is no longer displayed in a window. This causes later problems, because it will no longer be possible to wipe such a buffer. So just before entering the final buffer, check if the curbuf changed when calling the BufLeave autocommand and if it does (and curbuf is still valid), decrement curbuf->b_nwindows. Both issues can be verified using the provided test (however the second issue only because such an impacted buffer won't be wiped, causing futher issues in later tests). fixes: #13839 closes: #14104 Signed-off-by: Christian Brabandt <cb@256bit.org>

syntax: glob

# Unixen: object and executable files.
*.o
src/vim
src/xxd/xxd
src/auto/if_perl.c
src/auto/gui_gtk_gresources.c
src/auto/gui_gtk_gresources.h
src/auto/os_haiku.rdef
src/objects/.dirstamp
src/objects
src/types.vim

# We do need src/auto/configure.
src/auto/config.cache
src/auto/config.h
src/auto/config.log
src/auto/config.mk
src/auto/config.status
src/auto/osdef.h
src/auto/link.log
src/auto/link.sed
src/auto/pathdef.c

# Windows
*.exe
*.idb
*.exp
*.map
*.obj
*.pdb
*.ilk
*.sln
*.suo
*.res
*.RES
vim*.dll
vim*.lib
src/dobj*/pathdef.c
src/gobj*/pathdef.c
src/obj*/pathdef.c
src/Obj*/pathdef.c
gvimext.dll
gvimext.lib
gvim.lib
runtime/doc/uganda.nsis.txt
nsis/icons/*
/vim90/
.vscode/

# NetBeans
nbproject/*

# Mac OSX
src/xxd/xxd.dSYM
.DS_Store

# All platforms
*.rej
*.orig
*.mo
*.swp
*~
*.pyc
*.log
src/po/vim.pot
src/tags
/tags
/GPATH
/GTAGS
/GRTAGS
nsis/tags

# Generated by "make test"
src/po/*.ck
src/po/*.desktop
src/testdir/mbyte.vim
src/testdir/mzscheme.vim
src/testdir/lua.vim
src/testdir/small.vim
src/testdir/tiny.vim
src/testdir/test*.out
src/testdir/test*.failed
src/testdir/test.log
src/testdir/dostmp/*
src/testdir/messages
src/testdir/viminfo
src/testdir/opt_test.vim
src/testdir/failed
src/testdir/starttime
runtime/indent/testdir/*.out
runtime/indent/testdir/*.fail
src/memfile_test
src/json_test
src/message_test
src/kword_test

# Generated by "make install"
runtime/doc/doctags

# Generated by "make shadow".  The directory names could be anything but we
# restrict them to shadow (the default) or shadow-*
src/shadow
src/shadow-*
src/runtime
src/pixmaps

# other files possibly created by tools
src/cscope.out

# Linter/language server files
/.cache/clangd/
/.ccls-cache/
/compile_commands.json