patch 9.1.0764: [security]: use-after-free when closing a buffer
Problem: [security]: use-after-free when closing a buffer
Solution: When splitting the window and editing a new buffer,
check whether the newly to be edited buffer has been marked
for deletion and abort in this case
Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-rj48-v4mq-j4vg
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index acddd9c..b990de4 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -2743,6 +2743,18 @@
}
if (buf == NULL)
goto theend;
+ // autocommands try to edit a file that is goind to be removed,
+ // abort
+ if (buf_locked(buf))
+ {
+ // window was split, but not editing the new buffer,
+ // reset b_nwindows again
+ if (oldwin == NULL
+ && curwin->w_buffer != NULL
+ && curwin->w_buffer->b_nwindows > 1)
+ --curwin->w_buffer->b_nwindows;
+ goto theend;
+ }
if (curwin->w_alt_fnum == buf->b_fnum && prev_alt_fnum != 0)
// reusing the buffer, keep the old alternate file
curwin->w_alt_fnum = prev_alt_fnum;