diff options
author | Christian Brabandt <cb@256bit.org> | 2023-09-02 14:40:13 +0200 |
---|---|---|
committer | Christian Brabandt <cb@256bit.org> | 2023-09-02 14:44:47 +0200 |
commit | e1dc9a627536304bc4f738c21e909ad9fcf3974c (patch) | |
tree | 03d9e7d48d9db0cfd5321b735c542f642ff84860 /src/ex_cmds.c | |
parent | acb91d3905cfef5eff8edfb76e62a6b6bab1e91e (diff) |
patch 9.0.1840: [security] use-after-free in do_ecmdv9.0.1840
Problem: use-after-free in do_ecmd
Solution: Verify oldwin pointer after reset_VIsual()
Signed-off-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'src/ex_cmds.c')
-rw-r--r-- | src/ex_cmds.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/src/ex_cmds.c b/src/ex_cmds.c index 20d4d9a2ea..9348b4edda 100644 --- a/src/ex_cmds.c +++ b/src/ex_cmds.c @@ -2646,12 +2646,18 @@ do_ecmd( goto theend; } - /* - * End Visual mode before switching to another buffer, so the text can be - * copied into the GUI selection buffer. - */ + + // End Visual mode before switching to another buffer, so the text can be + // copied into the GUI selection buffer. + // Careful: may trigger ModeChanged() autocommand + + // Should we block autocommands here? reset_VIsual(); + // autocommands freed window :( + if (oldwin != NULL && !win_valid(oldwin)) + oldwin = NULL; + #if defined(FEAT_EVAL) if ((command != NULL || newlnum > (linenr_T)0) && *get_vim_var_str(VV_SWAPCOMMAND) == NUL) |