# HG changeset patch
# User Christian Brabandt <cb@256bit.org>
# Date 1708767007 -3600
# Node ID e0d4ce8ebf1253c487f57c43bb79e3a33dd235ca
# Parent  7c13c892deab4ca0d608b6abc09f904dd19bdded
patch 9.1.0130: [security]: UAF if win_split_ins autocommands delete "wp"

Commit: https://github.com/vim/vim/commit/abf7030a5c22257f066fa9c4061ad150d5a82577
Author: Sean Dewar <6256228+seandewar@users.noreply.github.com>
Date:   Sat Feb 24 10:20:24 2024 +0100

    patch 9.1.0130: [security]: UAF if win_split_ins autocommands delete "wp"

    Problem:  heap-use-after-free in win_splitmove if Enter/Leave
              autocommands from win_split_ins immediately closes "wp".
    Solution: check that "wp" is valid after win_split_ins.
              (Sean Dewar)

    closes: #14078

    Signed-off-by: Sean Dewar <6256228+seandewar@users.noreply.github.com>
    Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/testdir/test_window_cmd.vim b/src/testdir/test_window_cmd.vim
--- a/src/testdir/test_window_cmd.vim
+++ b/src/testdir/test_window_cmd.vim
@@ -1191,6 +1191,15 @@ func Test_win_splitmove()
   call assert_equal(v:true, s:triggered)
   unlet! s:triggered
 
+  split
+  let close_win = winnr('#')
+  augroup WinSplitMove
+    au!
+    au WinEnter * ++once quit!
+  augroup END
+  call win_splitmove(close_win, winnr())
+  call assert_equal(0, win_id2win(close_win))
+
   au! WinSplitMove
   augroup! WinSplitMove
   %bw!
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -705,6 +705,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    130,
+/**/
     129,
 /**/
     128,
diff --git a/src/window.c b/src/window.c
--- a/src/window.c
+++ b/src/window.c
@@ -1954,7 +1954,8 @@ win_splitmove(win_T *wp, int size, int f
     }
 
     // If splitting horizontally, try to preserve height.
-    if (size == 0 && !(flags & WSP_VERT))
+    // Note that win_split_ins autocommands may have immediately closed "wp"!
+    if (size == 0 && !(flags & WSP_VERT) && win_valid(wp))
     {
 	win_setheight_win(height, wp);
 	if (p_ea)