diff options
| author | Bram Moolenaar <Bram@vim.org> | 2021-02-07 12:12:43 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2021-02-07 12:12:43 +0100 |
| commit | 983d83ff1cd796ff321074335fa53fbe7ac45a46 (patch) | |
| tree | 04500912b576c2c91010495406d7e7332053c78f /src/buffer.c | |
| parent | dfc3db76b9de217542cc9258301c1b4818a51cd0 (diff) | |
patch 8.2.2476: using freed memory when splitting window while closing bufferv8.2.2476
Problem: Using freed memory when using an autocommand to split a window
while a buffer is being closed.
Solution: Disallow splitting when the buffer has b_locked_split set.
Diffstat (limited to 'src/buffer.c')
| -rw-r--r-- | src/buffer.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/src/buffer.c b/src/buffer.c index f9bffbf3d8..ca1fd36efe 100644 --- a/src/buffer.c +++ b/src/buffer.c @@ -595,6 +595,7 @@ close_buffer( if (buf->b_nwindows == 1) { ++buf->b_locked; + ++buf->b_locked_split; if (apply_autocmds(EVENT_BUFWINLEAVE, buf->b_fname, buf->b_fname, FALSE, buf) && !bufref_valid(&bufref)) @@ -605,6 +606,7 @@ aucmd_abort: return FALSE; } --buf->b_locked; + --buf->b_locked_split; if (abort_if_last && one_window()) // Autocommands made this the only window. goto aucmd_abort; @@ -614,12 +616,14 @@ aucmd_abort: if (!unload_buf) { ++buf->b_locked; + ++buf->b_locked_split; if (apply_autocmds(EVENT_BUFHIDDEN, buf->b_fname, buf->b_fname, FALSE, buf) && !bufref_valid(&bufref)) // Autocommands deleted the buffer. goto aucmd_abort; --buf->b_locked; + --buf->b_locked_split; if (abort_if_last && one_window()) // Autocommands made this the only window. goto aucmd_abort; @@ -800,6 +804,7 @@ buf_freeall(buf_T *buf, int flags) // Make sure the buffer isn't closed by autocommands. ++buf->b_locked; + ++buf->b_locked_split; set_bufref(&bufref, buf); if (buf->b_ml.ml_mfp != NULL) { @@ -826,6 +831,7 @@ buf_freeall(buf_T *buf, int flags) return; } --buf->b_locked; + --buf->b_locked_split; // If the buffer was in curwin and the window has changed, go back to that // window, if it still exists. This avoids that ":edit x" triggering a @@ -1718,8 +1724,8 @@ set_curbuf(buf_T *buf, int action) set_bufref(&prevbufref, prevbuf); set_bufref(&newbufref, buf); - // Autocommands may delete the current buffer and/or the buffer we want to go - // to. In those cases don't close the buffer. + // Autocommands may delete the current buffer and/or the buffer we want to + // go to. In those cases don't close the buffer. if (!apply_autocmds(EVENT_BUFLEAVE, NULL, NULL, FALSE, curbuf) || (bufref_valid(&prevbufref) && bufref_valid(&newbufref) |