patch 9.1.0130: [security]: UAF if win_split_ins autocommands delete "wp"
Problem: heap-use-after-free in win_splitmove if Enter/Leave
autocommands from win_split_ins immediately closes "wp".
Solution: check that "wp" is valid after win_split_ins.
(Sean Dewar)
closes: #14078
Signed-off-by: Sean Dewar <6256228+seandewar@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/testdir/test_window_cmd.vim b/src/testdir/test_window_cmd.vim
index a70fb79..917c432 100644
--- a/src/testdir/test_window_cmd.vim
+++ b/src/testdir/test_window_cmd.vim
@@ -1191,6 +1191,15 @@
call assert_equal(v:true, s:triggered)
unlet! s:triggered
+ split
+ let close_win = winnr('#')
+ augroup WinSplitMove
+ au!
+ au WinEnter * ++once quit!
+ augroup END
+ call win_splitmove(close_win, winnr())
+ call assert_equal(0, win_id2win(close_win))
+
au! WinSplitMove
augroup! WinSplitMove
%bw!