patch 9.1.0143: [security]: autocmd causes use-after-free in set_curbuf() Commit: https://github.com/vim/vim/commit/55f8bba73be5f9c3a5a4d0d6c5f56e65f2c7d3fc Author: Christian Brabandt <cb@256bit.org> Date: Wed Feb 28 23:32:00 2024 +0100 patch 9.1.0143: [security]: autocmd causes use-after-free in set_curbuf() Problem: [security]: autocmd cause use-after-free in set_curbuf() (kawarimidoll) Solution: check side-effect of BufLeave autocommand, when the number of windows changed, close windows containing buffers that will be wiped, if curbuf changed unexpectedly make sure b_nwindows is decremented otherwise it cannot be wiped set_curbuf() already makes some efforts to ensure the BufLeave autocommands do not cause issues. However there are still 2 issues that are not taken care of: 1) If a BufLeave autocommand opens a new window containing the same buffer as that is going got be closed in close_buffer() a bit later, we suddenly have another window open, containing a free'd buffer. So we must check if the number of windows changed and if it does (and the current buffer is going to be wiped (according to the 'bufhidden' setting), let's immediately close all windows containing the current buffer using close_windows() 2) If a BufLeave autocommand changes our current buffer (displays it in the current window), buf->b_nwindow will be incremented. As part of set_curbuf() we will however enter another buffer soon, which means, the newly created curbuf will have b_nwindows still have set, even so the buffer is no longer displayed in a window. This causes later problems, because it will no longer be possible to wipe such a buffer. So just before entering the final buffer, check if the curbuf changed when calling the BufLeave autocommand and if it does (and curbuf is still valid), decrement curbuf->b_nwindows. Both issues can be verified using the provided test (however the second issue only because such an impacted buffer won't be wiped, causing futher issues in later tests). fixes: #13839 closes: #14104 Signed-off-by: Christian Brabandt <cb@256bit.org>

README_ami.txt for version 9.1 of Vim: Vi IMproved.

This file explains the installation of Vim on Amiga systems.
See README.txt for general information about Vim.


Unpack the distributed files in the place where you want to keep them.  It is
wise to have a "vim" directory to keep your vimrc file and any other files you
change.  The distributed files go into a subdirectory.  This way you can
easily upgrade to a new version.  For example:

  dh0:editors/vim		contains your vimrc and modified files
  dh0:editors/vim/vim54		contains the Vim version 5.4 distributed files
  dh0:editors/vim/vim55		contains the Vim version 5.5 distributed files

You would then unpack the archives like this:

  cd dh0:editors
  tar xf t:vim91bin.tar
  tar xf t:vim91rt.tar

Set the $VIM environment variable to point to the top directory of your Vim
files.  For the above example:

  set VIM=dh0:editors/vim

Vim version 5.4 will look for your vimrc file in $VIM, and for the runtime
files in $VIM/vim54.  See ":help $VIM" for more information.

Make sure the Vim executable is in your search path.  Either copy the Vim
executable to a directory that is in your search path, or (preferred) modify
the search path to include the directory where the Vim executable is.