patch 9.1.0764: [security]: use-after-free when closing a buffer
Problem: [security]: use-after-free when closing a buffer
Solution: When splitting the window and editing a new buffer,
check whether the newly to be edited buffer has been marked
for deletion and abort in this case
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-rj48-v4mq-j4vg
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/buffer.c b/src/buffer.c
index 34500e4..90be301 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -497,6 +497,12 @@
return can_unload;
}
+ int
+buf_locked(buf_T *buf)
+{
+ return buf->b_locked || buf->b_locked_split;
+}
+
/*
* Close the link to a buffer.
* "action" is used when there is no longer a window for the buffer.