patch 9.1.1470: use-after-free with popup callback on error
Problem: use-after-free with popup callback on error
(Brian Carbone, lifepillar)
Solution: check if the popup window is valid before accessing it
fixes: #17558
closes: #17565
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/popupwin.c b/src/popupwin.c
index 199ffaf..536e1b6 100644
--- a/src/popupwin.c
+++ b/src/popupwin.c
@@ -2421,11 +2421,17 @@
/*
* Close popup "wp" and invoke any close callback for it.
+ * Careful: callback function might have freed the popup window already
*/
static void
popup_close_and_callback(win_T *wp, typval_T *arg)
{
- int id = wp->w_id;
+ int id;
+
+ if (!win_valid(wp))
+ return;
+
+ id = wp->w_id;
#ifdef FEAT_TERMINAL
if (wp == curwin && curbuf->b_term != NULL)