]> git.ipfire.org Git - thirdparty/vim.git/commit
patch 9.0.2140: [security]: use-after-free in win-enter v9.0.2140
authorChristian Brabandt <cb@256bit.org>
Tue, 28 Nov 2023 21:03:48 +0000 (22:03 +0100)
committerChristian Brabandt <cb@256bit.org>
Fri, 1 Dec 2023 17:58:50 +0000 (18:58 +0100)
commiteec0c2b3a4cfab93dd8d4adaa60638d47a2bbc8a
tree2f60c6c3095b52818325cbd6c92dcb293f8c8727
parent9cc95aa0d8f52bb0c906ca13297ce3a2ba615f2b
patch 9.0.2140: [security]: use-after-free in win-enter

Problem:  [security]: use-after-free in win-enter
Solution: validate window pointer before calling win_enter()

win_goto() may stop visual mode, if it is active. However, this may in
turn trigger the ModeChanged autocommand, which could potentially free
the wp pointer which was valid before now became stale and points to now
freed memory.

So before calling win_enter(), let's verify one more time, that the
wp pointer still points to a valid window structure.

Reported by @henices, thanks!

Signed-off-by: Christian Brabandt <cb@256bit.org>
src/testdir/crash/poc_win_enter_ext [new file with mode: 0644]
src/testdir/test_crash.vim
src/version.c
src/window.c