From: Christian Brabandt <cb@256bit.org>
Date: Sun, 3 Sep 2023 19:43:46 +0000 (+0200)
Subject: patch 9.0.1859: heap-use-after-free in bt_normal()
X-Git-Tag: v9.0.1859
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6e60cf444a8839ca1694319bf9a82e7b097e5c4d;p=thirdparty%2Fvim.git

patch 9.0.1859: heap-use-after-free in bt_normal()

Problem:  heap-use-after-free in bt_normal()
Solution: check that buffer is still valid

Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/buffer.c b/src/buffer.c
index 14eac92b97..93f9245f27 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -5777,7 +5777,7 @@ bt_normal(buf_T *buf)
 bt_quickfix(buf_T *buf UNUSED)
 {
 #ifdef FEAT_QUICKFIX
-    return buf != NULL && buf->b_p_bt[0] == 'q';
+    return buf != NULL && buf_valid(buf) && buf->b_p_bt[0] == 'q';
 #else
     return FALSE;
 #endif
diff --git a/src/testdir/crash/bt_quickfix1_poc b/src/testdir/crash/bt_quickfix1_poc
new file mode 100644
index 0000000000..97993fde52
--- /dev/null
+++ b/src/testdir/crash/bt_quickfix1_poc
@@ -0,0 +1,5 @@
+au BufReadPre * exe 'sn' .. expand("<abuf>")
+call writefile([''],'X')
+sil! e X
+call writefile([''],'X')
+sil! e X
diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
index 27bf7b55d4..8deb79702b 100644
--- a/src/testdir/test_crash.vim
+++ b/src/testdir/test_crash.vim
@@ -49,6 +49,15 @@ func Test_crash1()
 
   call TermWait(buf, 100)
 
+  let file = 'crash/bt_quickfix1_poc'
+  let args = printf(cmn_args, vim, file)
+  call term_sendkeys(buf, args ..
+    \ '  && echo "crash 6: [OK]" >> X_crash1_result.txt' .. "\<cr>")
+  " clean up
+  call delete('X')
+  " This test takes a bit longer
+  call TermWait(buf, 200)
+
   " clean up
   exe buf .. "bw!"
 
@@ -60,6 +69,7 @@ func Test_crash1()
       \ 'crash 3: [OK]',
       \ 'crash 4: [OK]',
       \ 'crash 5: [OK]',
+      \ 'crash 6: [OK]',
       \ ]
 
   call assert_equal(expected, getline(1, '$'))
diff --git a/src/version.c b/src/version.c
index b604b57f8b..f2ff8d6b70 100644
--- a/src/version.c
+++ b/src/version.c
@@ -699,6 +699,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1859,
 /**/
     1858,
 /**/