diff options
| author | Christian Brabandt <cb@256bit.org> | 2023-10-11 21:08:13 +0200 |
|---|---|---|
| committer | Christian Brabandt <cb@256bit.org> | 2023-10-11 21:09:53 +0200 |
| commit | 41e6f7d6ba67b61d911f9b1d76325cd79224753d (patch) | |
| tree | d2b6fcf5f7daa4712502d693635bcc3125bc38ca /src/buffer.c | |
| parent | 54844857fd6933fa4f6678e47610c4b9c9f7a091 (diff) | |
patch 9.0.2010: [security] use-after-free from buf_contents_changed()v9.0.2010
Problem: [security] use-after-free from buf_contents_changed()
Solution: block autocommands
Signed-off-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'src/buffer.c')
| -rw-r--r-- | src/buffer.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/buffer.c b/src/buffer.c index 93f9245f27..9ee74f54dd 100644 --- a/src/buffer.c +++ b/src/buffer.c @@ -6013,6 +6013,9 @@ buf_contents_changed(buf_T *buf) return TRUE; } + // We don't want to trigger autocommands now, they may have nasty + // side-effects like wiping buffers + block_autocmds(); if (ml_open(curbuf) == OK && readfile(buf->b_ffname, buf->b_fname, (linenr_T)0, (linenr_T)0, (linenr_T)MAXLNUM, @@ -6038,6 +6041,8 @@ buf_contents_changed(buf_T *buf) if (curbuf != newbuf) // safety check wipe_buffer(newbuf, FALSE); + unblock_autocmds(); + return differ; } |