patch 9.1.1361: [security]: possible use-after-free when closing a buffer
Problem: [security]: Possible to open more windows into a closing
buffer without splitting, bypassing existing "b_locked_split"
checks and triggering use-after-free
Solution: Disallow switching to a closing buffer. Editing a closing
buffer (via ":edit", etc.) was fixed in v9.1.0764, but add an
error message and check just "b_locked_split", as "b_locked"
is necessary only when the buffer shouldn't be wiped, and may
be set for buffers that are in-use but not actually closing.
(Sean Dewar)
closes: #17246
Signed-off-by: Sean Dewar <6256228+seandewar@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
index d5d516c..8d083db 100644
--- a/src/testdir/test_autocmd.vim
+++ b/src/testdir/test_autocmd.vim
@@ -5035,7 +5035,8 @@
exe "e " fname
vsp
augroup testing
- exe "au BufWinLeave " .. fname .. " :e " dummy .. "| vsp " .. fname
+ exe 'au BufWinLeave' fname 'e' dummy
+ \ '| call assert_fails(''vsp' fname ''', ''E1546:'')'
augroup END
bw
call CleanUpTestAuGroup()