patch 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data
Problem: heap-use-after-free in garbage collection with location list
user data.
Solution: Mark user data as in use when no other window is referencing
the location list (zeertzjq)
fixes: neovim/neovim#30371
closes: #15683
Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
index 47b9b47..0aa82ef 100644
--- a/src/testdir/test_quickfix.vim
+++ b/src/testdir/test_quickfix.vim
@@ -4208,6 +4208,18 @@
enew | only
endfunc
+" Similar to the problem above, but for user data.
+func Test_ll_window_user_data()
+ call setloclist(0, [#{bufnr: bufnr(), user_data: {}}])
+ lopen
+ wincmd t
+ close
+ call test_garbagecollect_now()
+ call feedkeys("\<CR>", 'tx')
+ call test_garbagecollect_now()
+ %bwipe!
+endfunc
+
" The following test used to crash vim
func Test_lfile_crash()
sp Xtest