patch 9.1.0678: [security]: use-after-free in alist_add()
Problem: [security]: use-after-free in alist_add()
(SuyueGuo)
Solution: Lock the current window, so that the reference to
the argument list remains valid.
This fixes CVE-2024-43374
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/terminal.c b/src/terminal.c
index 1fc0ef9..f801960 100644
--- a/src/terminal.c
+++ b/src/terminal.c
@@ -3680,10 +3680,10 @@
if (is_aucmd_win(curwin))
do_set_w_closing = TRUE;
if (do_set_w_closing)
- curwin->w_closing = TRUE;
+ curwin->w_locked = TRUE;
do_bufdel(DOBUF_WIPE, (char_u *)"", 1, fnum, fnum, FALSE);
if (do_set_w_closing)
- curwin->w_closing = FALSE;
+ curwin->w_locked = FALSE;
aucmd_restbuf(&aco);
}
#ifdef FEAT_PROP_POPUP