commit 41e6f7d6ba67b61d911f9b1d76325cd79224753d
author Christian Brabandt <cb@256bit.org> Wed Oct 11 21:08:13 2023 +0200
committer Christian Brabandt <cb@256bit.org> Wed Oct 11 21:09:53 2023 +0200
tree d2b6fcf5f7daa4712502d693635bcc3125bc38ca
parent 54844857fd6933fa4f6678e47610c4b9c9f7a091

patch 9.0.2010: [security] use-after-free from buf_contents_changed()

Problem:  [security] use-after-free from buf_contents_changed()
Solution: block autocommands

Signed-off-by: Christian Brabandt <cb@256bit.org>

src/testdir/crash/editing_arg_idx_POC_1

diff --git a/src/testdir/crash/editing_arg_idx_POC_1 b/src/testdir/crash/editing_arg_idx_POC_1
new file mode 100644
index 0000000..5d048d0
--- /dev/null
+++ b/src/testdir/crash/editing_arg_idx_POC_1
Binary files differ

src/testdir/test_crash.vim

diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
index 9a80340..5cd07e2 100644
--- a/src/testdir/test_crash.vim
+++ b/src/testdir/test_crash.vim
@@ -78,6 +78,14 @@
     \ '  && echo "crash 9: [OK]" >> X_crash1_result.txt' .. "\<cr>")
   call TermWait(buf, 1000)
 
+  let file = 'crash/editing_arg_idx_POC_1'
+  let args = printf(cmn_args, vim, file)
+  call term_sendkeys(buf, args ..
+    \ '  || echo "crash 10: [OK]" >> X_crash1_result.txt' .. "\<cr>")
+  call TermWait(buf, 1000)
+  call delete('Xerr')
+  call delete('@')
+
   " clean up
   exe buf .. "bw!"
 
@@ -93,6 +101,7 @@
       \ 'crash 7: [OK]',
       \ 'crash 8: [OK]',
       \ 'crash 9: [OK]',
+      \ 'crash 10: [OK]',
       \ ]
 
   call assert_equal(expected, getline(1, '$'))