patch 9.1.1982: Use after free with redraw_listener_add()

Problem:  Use after free with redraw_listener_add() (after: v9.1.1976)
Solution: Copy Callbacks into listener struct (Foxe Chen)

closes: #18926

Signed-off-by: Foxe Chen <chen.foxe@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/drawscreen.c b/src/drawscreen.c
index 6e37ccbabf1ce8d2dec1e9a1bf157f13366ceca1..ba6901d08bd5bc4c3865da65e1e880fd35a01f7e 100644 (file)
--- a/src/drawscreen.c
+++ b/src/drawscreen.c
@@ -3479,7 +3479,7 @@ f_redraw_listener_add(typval_T *argvars, typval_T *rettv)
            vim_free(rln);
            return;
        }
-       set_callback(&rln->rl_callbacks.on_start, &cb);
+       copy_callback(&rln->rl_callbacks.on_start, &cb);
        free_callback(&cb);
        clear_tv(&tv);
        got_one = true;
@@ -3496,7 +3496,7 @@ f_redraw_listener_add(typval_T *argvars, typval_T *rettv)
            vim_free(rln);
            return;
        }
-       set_callback(&rln->rl_callbacks.on_end, &cb);
+       copy_callback(&rln->rl_callbacks.on_end, &cb);
        free_callback(&cb);
        clear_tv(&tv);
        got_one = true;

diff --git a/src/testdir/test_listener.vim b/src/testdir/test_listener.vim
index 4b073af07fb30e7a5450e0b26bcb26b11f58762f..d3475cbc45483e5058f7230a5a5040e10e505387 100644 (file)
--- a/src/testdir/test_listener.vim
+++ b/src/testdir/test_listener.vim
@@ -774,4 +774,12 @@ func Test_redraw_remove_in_callback()
   call StopVimInTerminal(buf)
 endfunc
 
+func s:OnRedraw()
+endfunc
+
+" Test if partial is correctly ref'ed and doesn't cause use afte free error
+func Test_redraw_listener_partial()
+  call redraw_listener_add(#{on_start: function("s:OnRedraw", [1])})
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index 92005c71691779d2b86b24e4e4d039f88cb3b78c..a3e2f5127d398aa3aa792bda30fb8b05180b1d6c 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1982,
 /**/
     1981,
 /**/