commit be4bd189d23854ddf1d85ad291d8f7ad3f22b7a0
author zeertzjq <zeertzjq@outlook.com> Sat Sep 14 10:32:31 2024 +0200
committer Christian Brabandt <cb@256bit.org> Sat Sep 14 10:34:53 2024 +0200
tree a96d7982ce3ae6c7bbd66317aa8644e89de3b880
parent d657d3d8fd635dbd78402358788dc58a96d04117

patch 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data

Problem:  heap-use-after-free in garbage collection with location list
          user data.
Solution: Mark user data as in use when no other window is referencing
          the location list (zeertzjq)

fixes: neovim/neovim#30371
closes: #15683

Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

src/quickfix.c

diff --git a/src/quickfix.c b/src/quickfix.c
index 414fe65..6f7d3a5 100644
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -8011,6 +8011,10 @@
 	    abort = mark_quickfix_ctx(win->w_llist_ref, copyID);
 	    if (abort)
 		return abort;
+
+	    abort = mark_quickfix_user_data(win->w_llist_ref, copyID);
+	    if (abort)
+		return abort;
 	}
     }
 

src/testdir/test_quickfix.vim

diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
index 47b9b47..0aa82ef 100644
--- a/src/testdir/test_quickfix.vim
+++ b/src/testdir/test_quickfix.vim
@@ -4208,6 +4208,18 @@
   enew | only
 endfunc
 
+" Similar to the problem above, but for user data.
+func Test_ll_window_user_data()
+  call setloclist(0, [#{bufnr: bufnr(), user_data: {}}])
+  lopen
+  wincmd t
+  close
+  call test_garbagecollect_now()
+  call feedkeys("\<CR>", 'tx')
+  call test_garbagecollect_now()
+  %bwipe!
+endfunc
+
 " The following test used to crash vim
 func Test_lfile_crash()
   sp Xtest

src/version.c

diff --git a/src/version.c b/src/version.c
index 782f431..ba33f43 100644
--- a/src/version.c
+++ b/src/version.c
@@ -705,6 +705,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    728,
+/**/
     727,
 /**/
     726,