From: Bram Moolenaar <Bram@vim.org>
Date: Sun, 12 Jun 2022 10:49:16 +0000 (+0100)
Subject: patch 8.2.5079: DirChanged autocommand may use freed memory
X-Git-Tag: v8.2.5079
X-Git-Url: http://git.ipfire.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=d8c9d32c8932e93008bfd4e8828ed42f4e9f8315;p=thirdparty%2Fvim.git

patch 8.2.5079: DirChanged autocommand may use freed memory

Problem:    DirChanged autocommand may use freed memory. (Shane-XB Qian)
Solution:   Free the memory later. (closes #10555)
---

diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index 634a1bcef5..9a06999e7c 100644
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -7525,6 +7525,7 @@ changedir_func(
     int		dir_differs;
     char_u	*acmd_fname = NULL;
     char_u	**pp;
+    char_u	*tofree;
 
     if (new_dir == NULL || allbuf_locked())
 	return FALSE;
@@ -7601,13 +7602,14 @@ changedir_func(
 	pp = &curtab->tp_prevdir;
     else
 	pp = &prev_dir;
-    vim_free(*pp);
+    tofree = *pp;  // new_dir may use this
     *pp = pdir;
 
     post_chdir(scope);
 
     if (dir_differs)
 	apply_autocmds(EVENT_DIRCHANGED, acmd_fname, new_dir, FALSE, curbuf);
+    vim_free(tofree);
     return TRUE;
 }
 
diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
index 24e2ed9842..15aab48a69 100644
--- a/src/testdir/test_autocmd.vim
+++ b/src/testdir/test_autocmd.vim
@@ -2107,6 +2107,13 @@ function Test_dirchanged_global()
   call assert_equal(expected, s:li)
   exe 'lcd ' .. fnameescape(s:dir_bar)
   call assert_equal(expected, s:li)
+
+  exe 'cd ' .. s:dir_foo
+  exe 'cd ' .. s:dir_bar
+  autocmd! test_dirchanged DirChanged global let g:result = expand("<afile>")
+  cd -
+  call assert_equal(s:dir_foo, g:result)
+
   call s:After_test_dirchanged()
 endfunc
 
diff --git a/src/version.c b/src/version.c
index aec6f4b279..47c24667e6 100644
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    5079,
 /**/
     5078,
 /**/