patch 9.0.2106: [security]: Use-after-free in win_close()

Problem:  [security]: Use-after-free in win_close()
Solution: Check window is valid, before accessing it

If the current window structure is no longer valid (because a previous
autocommand has already freed this window), fail and return before
attempting to set win->w_closing variable.

Add a test to trigger ASAN in CI

Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/testdir/crash/poc1 b/src/testdir/crash/poc1
new file mode 100644 (file)
index 0000000..ec223f1
Binary files /dev/null and b/src/testdir/crash/poc1 differ

diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
index 5cd07e2a3f0b53a0ec5b766a6f86b1f29fab18e7..b093b053c59dd1542d043e729e51d706fdb40c5f 100644 (file)
--- a/src/testdir/test_crash.vim
+++ b/src/testdir/test_crash.vim
@@ -110,6 +110,39 @@ func Test_crash1()
   call delete('X_crash1_result.txt')
 endfunc
 
+func Test_crash1_2()
+  CheckNotBSD
+  CheckExecutable dash
+
+  " The following used to crash Vim
+  let opts = #{cmd: 'sh'}
+  let vim  = GetVimProg()
+  let result = 'X_crash1_1_result.txt'
+
+  let buf = RunVimInTerminal('sh', opts)
+
+  let file = 'crash/poc1'
+  let cmn_args = "%s -u NONE -i NONE -n -e -s -S %s -c ':qa!'"
+  let args = printf(cmn_args, vim, file)
+  call term_sendkeys(buf, args ..
+    \ '  && echo "crash 1: [OK]" > '.. result .. "\<cr>")
+  call TermWait(buf, 150)
+
+  " clean up
+  exe buf .. "bw!"
+
+  exe "sp " .. result
+
+  let expected = [
+      \ 'crash 1: [OK]',
+      \ ]
+
+  call assert_equal(expected, getline(1, '$'))
+  bw!
+
+  call delete(result)
+endfunc
+
 func Test_crash2()
   " The following used to crash Vim
   let opts = #{wait_for_ruler: 0, rows: 20}

diff --git a/src/version.c b/src/version.c
index f9d1593c0dd566e17912f4a37b3dc27d8449cf38..ec021985f25803e14b9bf5f30bf42ec116ee0a0a 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2106,
 /**/
     2105,
 /**/

diff --git a/src/window.c b/src/window.c
index f77ede330d304ffbd0d65ef42e050ff1039da1e8..55ce31c8864373303f333d46959354243b85e025 100644 (file)
--- a/src/window.c
+++ b/src/window.c
@@ -2682,6 +2682,8 @@ win_close(win_T *win, int free_buf)
            reset_VIsual_and_resel();   // stop Visual mode
 
            other_buffer = TRUE;
+           if (!win_valid(win))
+               return FAIL;
            win->w_closing = TRUE;
            apply_autocmds(EVENT_BUFLEAVE, NULL, NULL, FALSE, curbuf);
            if (!win_valid(win))