patch 9.1.0728: [security]: heap-use-after-free in garbage collection with 
location list user data

Commit: 
https://github.com/vim/vim/commit/be4bd189d23854ddf1d85ad291d8f7ad3f22b7a0
Author: zeertzjq <zeert...@outlook.com>
Date:   Sat Sep 14 10:32:31 2024 +0200

    patch 9.1.0728: [security]: heap-use-after-free in garbage collection with 
location list user data
    
    Problem:  heap-use-after-free in garbage collection with location list
              user data.
    Solution: Mark user data as in use when no other window is referencing
              the location list (zeertzjq)
    
    fixes: neovim/neovim#30371
    closes: #15683
    
    Signed-off-by: zeertzjq <zeert...@outlook.com>
    Signed-off-by: Christian Brabandt <c...@256bit.org>

diff --git a/src/quickfix.c b/src/quickfix.c
index 414fe650d..6f7d3a58b 100644
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -8011,6 +8011,10 @@ set_ref_in_quickfix(int copyID)
            abort = mark_quickfix_ctx(win->w_llist_ref, copyID);
            if (abort)
                return abort;
+
+           abort = mark_quickfix_user_data(win->w_llist_ref, copyID);
+           if (abort)
+               return abort;
        }
     }
 
diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
index 47b9b4703..0aa82ef74 100644
--- a/src/testdir/test_quickfix.vim
+++ b/src/testdir/test_quickfix.vim
@@ -4208,6 +4208,18 @@ func Test_ll_window_ctx()
   enew | only
 endfunc
 
+" Similar to the problem above, but for user data.
+func Test_ll_window_user_data()
+  call setloclist(0, [#{bufnr: bufnr(), user_data: {}}])
+  lopen
+  wincmd t
+  close
+  call test_garbagecollect_now()
+  call feedkeys("\<CR>", 'tx')
+  call test_garbagecollect_now()
+  %bwipe!
+endfunc
+
 " The following test used to crash vim
 func Test_lfile_crash()
   sp Xtest
diff --git a/src/version.c b/src/version.c
index 782f4318f..ba33f431d 100644
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    728,
 /**/
     727,
 /**/

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to vim_dev+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/vim_dev/E1spOOw-00FiHP-Lj%40256bit.org.

Raspunde prin e-mail lui