patch 9.0.1859: heap-use-after-free in bt_normal()
Problem: heap-use-after-free in bt_normal()
Solution: check that buffer is still valid
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/testdir/crash/bt_quickfix1_poc b/src/testdir/crash/bt_quickfix1_poc
new file mode 100644
index 0000000..97993fd
--- /dev/null
+++ b/src/testdir/crash/bt_quickfix1_poc
@@ -0,0 +1,5 @@
+au BufReadPre * exe 'sn' .. expand("<abuf>")
+call writefile([''],'X')
+sil! e X
+call writefile([''],'X')
+sil! e X
diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
index 27bf7b5..8deb797 100644
--- a/src/testdir/test_crash.vim
+++ b/src/testdir/test_crash.vim
@@ -49,6 +49,15 @@
call TermWait(buf, 100)
+ let file = 'crash/bt_quickfix1_poc'
+ let args = printf(cmn_args, vim, file)
+ call term_sendkeys(buf, args ..
+ \ ' && echo "crash 6: [OK]" >> X_crash1_result.txt' .. "\<cr>")
+ " clean up
+ call delete('X')
+ " This test takes a bit longer
+ call TermWait(buf, 200)
+
" clean up
exe buf .. "bw!"
@@ -60,6 +69,7 @@
\ 'crash 3: [OK]',
\ 'crash 4: [OK]',
\ 'crash 5: [OK]',
+ \ 'crash 6: [OK]',
\ ]
call assert_equal(expected, getline(1, '$'))