Commit: patch 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data

[Christian Brabandt]

patch 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data

Commit: https://github.com/vim/vim/commit/be4bd189d23854ddf1d85ad291d8f7ad3f22b7a0
Author: zeertzjq <zeer...@outlook.com>
Date: Sat Sep 14 10:32:31 2024 +0200

patch 9.1.0728: [security]: heap-use-after-free in garbage collection with location list user data

Problem: heap-use-after-free in garbage collection with location list
user data.
Solution: Mark user data as in use when no other window is referencing
the location list (zeertzjq)

fixes: neovim/neovim#30371
closes: #15683

Signed-off-by: zeertzjq <zeer...@outlook.com>
Signed-off-by: Christian Brabandt <c...@256bit.org>

diff --git a/src/quickfix.c b/src/quickfix.c
index 414fe650d..6f7d3a58b 100644
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -8011,6 +8011,10 @@ set_ref_in_quickfix(int copyID)
abort = mark_quickfix_ctx(win->w_llist_ref, copyID);
if (abort)
return abort;
+
+ abort = mark_quickfix_user_data(win->w_llist_ref, copyID);
+ if (abort)
+ return abort;
}
}

diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
index 47b9b4703..0aa82ef74 100644
--- a/src/testdir/test_quickfix.vim
+++ b/src/testdir/test_quickfix.vim
@@ -4208,6 +4208,18 @@ func Test_ll_window_ctx()
enew | only
endfunc

+" Similar to the problem above, but for user data.
+func Test_ll_window_user_data()
+ call setloclist(0, [#{bufnr: bufnr(), user_data: {}}])
+ lopen
+ wincmd t
+ close
+ call test_garbagecollect_now()
+ call feedkeys("\<CR>", 'tx')
+ call test_garbagecollect_now()
+ %bwipe!
+endfunc
+
" The following test used to crash vim
func Test_lfile_crash()
sp Xtest
diff --git a/src/version.c b/src/version.c
index 782f4318f..ba33f431d 100644
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 728,
/**/
727,
/**/