patch 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data
Commit: https://github.com/vim/vim/commit/be4bd189d23854ddf1d85ad291d8f7ad3f22b7a0 Author: zeertzjq <zeert...@outlook.com> Date: Sat Sep 14 10:32:31 2024 +0200 patch 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data Problem: heap-use-after-free in garbage collection with location list user data. Solution: Mark user data as in use when no other window is referencing the location list (zeertzjq) fixes: neovim/neovim#30371 closes: #15683 Signed-off-by: zeertzjq <zeert...@outlook.com> Signed-off-by: Christian Brabandt <c...@256bit.org> diff --git a/src/quickfix.c b/src/quickfix.c index 414fe650d..6f7d3a58b 100644 --- a/src/quickfix.c +++ b/src/quickfix.c @@ -8011,6 +8011,10 @@ set_ref_in_quickfix(int copyID) abort = mark_quickfix_ctx(win->w_llist_ref, copyID); if (abort) return abort; + + abort = mark_quickfix_user_data(win->w_llist_ref, copyID); + if (abort) + return abort; } } diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim index 47b9b4703..0aa82ef74 100644 --- a/src/testdir/test_quickfix.vim +++ b/src/testdir/test_quickfix.vim @@ -4208,6 +4208,18 @@ func Test_ll_window_ctx() enew | only endfunc +" Similar to the problem above, but for user data. +func Test_ll_window_user_data() + call setloclist(0, [#{bufnr: bufnr(), user_data: {}}]) + lopen + wincmd t + close + call test_garbagecollect_now() + call feedkeys("\<CR>", 'tx') + call test_garbagecollect_now() + %bwipe! +endfunc + " The following test used to crash vim func Test_lfile_crash() sp Xtest diff --git a/src/version.c b/src/version.c index 782f4318f..ba33f431d 100644 --- a/src/version.c +++ b/src/version.c @@ -704,6 +704,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 728, /**/ 727, /**/ -- -- You received this message from the "vim_dev" maillist. Do not top-post! Type your reply below the text you are replying to. For more information, visit http://www.vim.org/maillist.php --- You received this message because you are subscribed to the Google Groups "vim_dev" group. To unsubscribe from this group and stop receiving emails from it, send an email to vim_dev+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/vim_dev/E1spOOw-00FiHP-Lj%40256bit.org.