patch 9.1.0130: [security]: UAF if win_split_ins autocommands delete "wp"
Problem: heap-use-after-free in win_splitmove if Enter/Leave
autocommands from win_split_ins immediately closes "wp".
Solution: check that "wp" is valid after win_split_ins.
(Sean Dewar)
closes: #14078
Signed-off-by: Sean Dewar <6256228+seandewar@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/window.c b/src/window.c
index 66a1d7d..7123780 100644
--- a/src/window.c
+++ b/src/window.c
@@ -1954,7 +1954,8 @@
}
// If splitting horizontally, try to preserve height.
- if (size == 0 && !(flags & WSP_VERT))
+ // Note that win_split_ins autocommands may have immediately closed "wp"!
+ if (size == 0 && !(flags & WSP_VERT) && win_valid(wp))
{
win_setheight_win(height, wp);
if (p_ea)