adam/vim
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

patch 9.1.1375: [security]: possible heap UAF with quickfix dummy buffer

Browse Source 
Problem:  heap use-after-free possible when autocommands switch away from the
          quickfix dummy buffer, but leave it open in a window.
Solution: close its windows first before attempting the wipe.
          (Sean Dewar)

related: #17283

Signed-off-by: Sean Dewar <6256228+seandewar@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
Sean Dewar
2025-05-10 14:30:36 +02:00
committed by Christian Brabandt
parent 9955c125fa
commit b4074ead5c
3 changed files with 34 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/quickfix.c
View File

@ -7026,7 +7026,11 @@ load_dummy_buffer(
aucmd_restbuf(&aco);
if (newbuf_to_wipe.br_buf != NULL && bufref_valid(&newbuf_to_wipe))
wipe_buffer(newbuf_to_wipe.br_buf, FALSE);
{
block_autocmds();
wipe_dummy_buffer(newbuf_to_wipe.br_buf, NULL);
unblock_autocmds();
}
}
// Add back the "dummy" flag, otherwise buflist_findname_stat() won't
@ -7052,8 +7056,8 @@ load_dummy_buffer(
/*
* Wipe out the dummy buffer that load_dummy_buffer() created. Restores
* directory to "dirname_start" prior to returning, if autocmds or the
* 'autochdir' option have changed it.
* directory to "dirname_start" if not NULL prior to returning, if autocmds or
* the 'autochdir' option have changed it.
*/
static void
wipe_dummy_buffer(buf_T *buf, char_u *dirname_start)
@ -7095,8 +7099,9 @@ wipe_dummy_buffer(buf_T *buf, char_u *dirname_start)
// new aborting error, interrupt, or uncaught exception.
leave_cleanup(&cs);
#endif
// When autocommands/'autochdir' option changed directory: go back.
restore_start_dir(dirname_start);
if (dirname_start != NULL)
// When autocommands/'autochdir' option changed directory: go back.
restore_start_dir(dirname_start);
}
}