patch 8.2.2476: using freed memory when splitting window while closing buffer
Problem: Using freed memory when using an autocommand to split a window
while a buffer is being closed.
Solution: Disallow splitting when the buffer has b_locked_split set.
diff --git a/src/window.c b/src/window.c
index bea4f39..58a216d 100644
--- a/src/window.c
+++ b/src/window.c
@@ -769,6 +769,11 @@
emsg(_("E242: Can't split a window while closing another"));
return FAIL;
}
+ if (curwin->w_buffer->b_locked_split)
+ {
+ emsg(_(e_cannot_split_window_when_closing_buffer));
+ return FAIL;
+ }
return OK;
}
@@ -793,6 +798,9 @@
if (ERROR_IF_ANY_POPUP_WINDOW)
return FAIL;
+ if (check_split_disallowed() == FAIL)
+ return FAIL;
+
// When the ":tab" modifier was used open a new tab page instead.
if (may_open_tabpage() == OK)
return OK;
@@ -804,8 +812,6 @@
emsg(_("E442: Can't split topleft and botright at the same time"));
return FAIL;
}
- if (check_split_disallowed() == FAIL)
- return FAIL;
// When creating the help window make a snapshot of the window layout.
// Otherwise clear the snapshot, it's now invalid.