commit 6e60cf444a8839ca1694319bf9a82e7b097e5c4d
author Christian Brabandt <cb@256bit.org> Sun Sep 03 21:43:46 2023 +0200
committer Christian Brabandt <cb@256bit.org> Sun Sep 03 21:43:46 2023 +0200
tree 0ae96b7f0834c9e82cd174dda7683eb209dd46e3
parent ee9166eb3b41846661a39b662dc7ebe8b5e15139

patch 9.0.1859: heap-use-after-free in bt_normal()

Problem:  heap-use-after-free in bt_normal()
Solution: check that buffer is still valid

Signed-off-by: Christian Brabandt <cb@256bit.org>

src/testdir/crash/bt_quickfix1_poc

diff --git a/src/testdir/crash/bt_quickfix1_poc b/src/testdir/crash/bt_quickfix1_poc
new file mode 100644
index 0000000..97993fd
--- /dev/null
+++ b/src/testdir/crash/bt_quickfix1_poc
@@ -0,0 +1,5 @@
+au BufReadPre * exe 'sn' .. expand("<abuf>")
+call writefile([''],'X')
+sil! e X
+call writefile([''],'X')
+sil! e X