[vim/vim] Use-after-free in winframe_remove() (PR #19064)

[Christian Brabandt]

Problem: Use-after-free in winframe_remove
Solution: Set window_layout_locked() inside winframe_remove()
and check that writing diff files is disallowed when the
window layout is locked

ping @ychin as we discussed this issue recently. Thanks 🙏

---

You can view, comment on, or merge this pull request online at:

  https://github.com/vim/vim/pull/19064

Commit Summary

• 0d96a84 Use-after-free in winframe_remove()

File Changes

(4 files)

• M src/diff.c (7)
• M src/proto/window.pro (1)
• M src/testdir/test_diffmode.vim (32)
• M src/window.c (14)

Patch Links:

• https://github.com/vim/vim/pull/19064.patch
• https://github.com/vim/vim/pull/19064.diff

—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.Message ID: <vim/vim/pull/19064@github.com>

[Christian Brabandt]

Closed #19064 via ead1dda.

—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you are subscribed to this thread.Message ID: <vim/vim/pull/19064/issue_event/22028471896@github.com>