patch 9.1.0143: [security]: autocmd causes use-after-free in set_curbuf() Commit: https://github.com/vim/vim/commit/55f8bba73be5f9c3a5a4d0d6c5f56e65f2c7d3fc Author: Christian Brabandt <cb@256bit.org> Date: Wed Feb 28 23:32:00 2024 +0100 patch 9.1.0143: [security]: autocmd causes use-after-free in set_curbuf() Problem: [security]: autocmd cause use-after-free in set_curbuf() (kawarimidoll) Solution: check side-effect of BufLeave autocommand, when the number of windows changed, close windows containing buffers that will be wiped, if curbuf changed unexpectedly make sure b_nwindows is decremented otherwise it cannot be wiped set_curbuf() already makes some efforts to ensure the BufLeave autocommands do not cause issues. However there are still 2 issues that are not taken care of: 1) If a BufLeave autocommand opens a new window containing the same buffer as that is going got be closed in close_buffer() a bit later, we suddenly have another window open, containing a free'd buffer. So we must check if the number of windows changed and if it does (and the current buffer is going to be wiped (according to the 'bufhidden' setting), let's immediately close all windows containing the current buffer using close_windows() 2) If a BufLeave autocommand changes our current buffer (displays it in the current window), buf->b_nwindow will be incremented. As part of set_curbuf() we will however enter another buffer soon, which means, the newly created curbuf will have b_nwindows still have set, even so the buffer is no longer displayed in a window. This causes later problems, because it will no longer be possible to wipe such a buffer. So just before entering the final buffer, check if the curbuf changed when calling the BufLeave autocommand and if it does (and curbuf is still valid), decrement curbuf->b_nwindows. Both issues can be verified using the provided test (however the second issue only because such an impacted buffer won't be wiped, causing futher issues in later tests). fixes: #13839 closes: #14104 Signed-off-by: Christian Brabandt <cb@256bit.org>

Vim		Vi IMproved.  A clone of the UNIX text editor Vi.  Very useful
		for editing programs and other plain ASCII text.  Full Vi
		compatibility and includes all Ex commands.  Extra features
		above Vi: Multilevel undo, multiple windows, syntax
		highlighting, command line history, folding, improved command
		line editing, command typeahead display, command to display
		yank buffers, possibility to edit binary files, file name
		stack, support for Manx QuickFix and other compiler's error
		messages, shows current file name in window title, on-line
		help, rectangular cut/paste, etc., etc., etc...

		Version 9.1.  Also runs under UNIX, MS-Windows, Mac, etc.
		vim91rt.tgz  contains the documentation and syntax files.
		vim91bin.tgz contains the binaries.
		vim91src.tgz contains the sources.
		Author: Bram Moolenaar et al.


Xxd		Hex dumper and reader.  Can be used to view files as hex, edit
		them and write them back.  Can also be used to patch files.

		Version 2023 Oct 25
		Author: Juergen Weigert