patch 9.2.0594: Use-after-free with ":wqall" and a running terminal job
Commit: https://github.com/vim/vim/commit/3ba82a5e48fd238defdd2bd6d69bd825b8099227 Author: Hirohito Higashi <[email protected]> Date: Thu Jun 4 19:25:50 2026 +0000 patch 9.2.0594: Use-after-free with ":wqall" and a running terminal job Problem: Using ":wqall" with a running terminal buffer can free the buffer that is currently being iterated over in the buffer list, resulting in a use-after-free (after v9.2.0593). Solution: After stopping the job, check whether the buffer is still valid and restart the iteration from the first buffer if it was freed (Hirohito Higashi). related: #20417 closes: #20423 Signed-off-by: Hirohito Higashi <[email protected]> Signed-off-by: Christian Brabandt <[email protected]> diff --git a/src/ex_cmds.c b/src/ex_cmds.c index cedb9edf8..b2fc85c99 100644 --- a/src/ex_cmds.c +++ b/src/ex_cmds.c @@ -2515,11 +2515,17 @@ do_wqall(exarg_T *eap) #ifdef FEAT_TERMINAL if (exiting && !eap->forceit && term_job_running(buf->b_term)) { + bufref_T bufref; + + set_bufref(&bufref, buf); if (term_try_stop_job(buf) == FAIL) { no_write_message_buf(buf); ++error; } + // Stopping the job may have freed the terminal buffer. + else if (!bufref_valid(&bufref)) + buf = firstbuf; } else #endif diff --git a/src/version.c b/src/version.c index cacb63cb8..65550ac00 100644 --- a/src/version.c +++ b/src/version.c @@ -729,6 +729,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 594, /**/ 593, /**/ -- -- You received this message from the "vim_dev" maillist. Do not top-post! Type your reply below the text you are replying to. For more information, visit http://www.vim.org/maillist.php --- You received this message because you are subscribed to the Google Groups "vim_dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/d/msgid/vim_dev/E1wVE00-005bQD-Ij%40256bit.org.
