diff options
| author | Sean Dewar <6256228+seandewar@users.noreply.github.com> | 2024-02-24 10:20:24 +0100 |
|---|---|---|
| committer | Christian Brabandt <cb@256bit.org> | 2024-02-24 10:20:24 +0100 |
| commit | abf7030a5c22257f066fa9c4061ad150d5a82577 (patch) | |
| tree | 184d5d96f930bd0bb36324b8943cd34749332bfe /src/testdir | |
| parent | f548ae7b6357c7934411df243bc987800c9b76d1 (diff) | |
patch 9.1.0130: [security]: UAF if win_split_ins autocommands delete "wp"v9.1.0130
Problem: heap-use-after-free in win_splitmove if Enter/Leave
autocommands from win_split_ins immediately closes "wp".
Solution: check that "wp" is valid after win_split_ins.
(Sean Dewar)
closes: #14078
Signed-off-by: Sean Dewar <6256228+seandewar@users.noreply.github.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'src/testdir')
| -rw-r--r-- | src/testdir/test_window_cmd.vim | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/src/testdir/test_window_cmd.vim b/src/testdir/test_window_cmd.vim index a70fb790c5..917c43203c 100644 --- a/src/testdir/test_window_cmd.vim +++ b/src/testdir/test_window_cmd.vim @@ -1191,6 +1191,15 @@ func Test_win_splitmove() call assert_equal(v:true, s:triggered) unlet! s:triggered + split + let close_win = winnr('#') + augroup WinSplitMove + au! + au WinEnter * ++once quit! + augroup END + call win_splitmove(close_win, winnr()) + call assert_equal(0, win_id2win(close_win)) + au! WinSplitMove augroup! WinSplitMove %bw! |