Mercurial > vim
changeset 36137:a75a21b27701 v9.1.0728
patch 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data
Commit: https://github.com/vim/vim/commit/be4bd189d23854ddf1d85ad291d8f7ad3f22b7a0
Author: zeertzjq <zeertzjq@outlook.com>
Date: Sat Sep 14 10:32:31 2024 +0200
patch 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data
Problem: heap-use-after-free in garbage collection with location list
user data.
Solution: Mark user data as in use when no other window is referencing
the location list (zeertzjq)
fixes: neovim/neovim#30371
closes: #15683
Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Sat, 14 Sep 2024 10:45:05 +0200 |
| parents | 418b8e744263 |
| children | 1bd0fa926b75 |
| files | src/quickfix.c src/testdir/test_quickfix.vim src/version.c |
| diffstat | 3 files changed, 18 insertions(+), 0 deletions(-) [+] |
line wrap: on
line diff
--- a/src/quickfix.c +++ b/src/quickfix.c @@ -8011,6 +8011,10 @@ set_ref_in_quickfix(int copyID) abort = mark_quickfix_ctx(win->w_llist_ref, copyID); if (abort) return abort; + + abort = mark_quickfix_user_data(win->w_llist_ref, copyID); + if (abort) + return abort; } }
--- a/src/testdir/test_quickfix.vim +++ b/src/testdir/test_quickfix.vim @@ -4208,6 +4208,18 @@ func Test_ll_window_ctx() enew | only endfunc +" Similar to the problem above, but for user data. +func Test_ll_window_user_data() + call setloclist(0, [#{bufnr: bufnr(), user_data: {}}]) + lopen + wincmd t + close + call test_garbagecollect_now() + call feedkeys("\<CR>", 'tx') + call test_garbagecollect_now() + %bwipe! +endfunc + " The following test used to crash vim func Test_lfile_crash() sp Xtest