patch 9.0.1859: heap-use-after-free in bt_normal()
Commit:
https://github.com/vim/vim/commit/6e60cf444a8839ca1694319bf9a82e7b097e5c4d
Author: Christian Brabandt <c...@256bit.org>
Date: Sun Sep 3 21:43:46 2023 +0200
patch 9.0.1859: heap-use-after-free in bt_normal()
Problem: heap-use-after-free in bt_normal()
Solution: check that buffer is still valid
Signed-off-by: Christian Brabandt <c...@256bit.org>
diff --git a/src/buffer.c b/src/buffer.c
index 14eac92b9..93f9245f2 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -5777,7 +5777,7 @@ bt_normal(buf_T *buf)
bt_quickfix(buf_T *buf UNUSED)
{
#ifdef FEAT_QUICKFIX
- return buf != NULL && buf->b_p_bt[0] == 'q';
+ return buf != NULL && buf_valid(buf) && buf->b_p_bt[0] == 'q';
#else
return FALSE;
#endif
diff --git a/src/testdir/crash/bt_quickfix1_poc
b/src/testdir/crash/bt_quickfix1_poc
new file mode 100644
index 000000000..97993fde5
--- /dev/null
+++ b/src/testdir/crash/bt_quickfix1_poc
@@ -0,0 +1,5 @@
+au BufReadPre * exe 'sn' .. expand("<abuf>")
+call writefile([''],'X')
+sil! e X
+call writefile([''],'X')
+sil! e X
diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
index 27bf7b55d..8deb79702 100644
--- a/src/testdir/test_crash.vim
+++ b/src/testdir/test_crash.vim
@@ -49,6 +49,15 @@ func Test_crash1()
call TermWait(buf, 100)
+ let file = 'crash/bt_quickfix1_poc'
+ let args = printf(cmn_args, vim, file)
+ call term_sendkeys(buf, args ..
+ \ ' && echo "crash 6: [OK]" >> X_crash1_result.txt' .. "\<cr>")
+ " clean up
+ call delete('X')
+ " This test takes a bit longer
+ call TermWait(buf, 200)
+
" clean up
exe buf .. "bw!"
@@ -60,6 +69,7 @@ func Test_crash1()
\ 'crash 3: [OK]',
\ 'crash 4: [OK]',
\ 'crash 5: [OK]',
+ \ 'crash 6: [OK]',
\ ]
call assert_equal(expected, getline(1, '$'))
diff --git a/src/version.c b/src/version.c
index b604b57f8..f2ff8d6b7 100644
--- a/src/version.c
+++ b/src/version.c
@@ -699,6 +699,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 1859,
/**/
1858,
/**/
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to vim_dev+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/vim_dev/E1qctGM-00DwYZ-Uj%40256bit.org.
