[vim/vim] Fix use-after-free in GTK4 clipboard read on timeout (PR #20467)

[mattn]

clip_mch_request_selection() kept the read state on the stack and read the clipboard with a 3-second timeout. On a timeout it returned while the async read was still pending, so when the callback finally fired it wrote into the freed stack frame and passed a stale Clipboard_T into clip_yank_selection(). Heap-allocate the state and hand ownership to the callback on timeout.

---

You can view, comment on, or merge this pull request online at:

  https://github.com/vim/vim/pull/20467

Commit Summary

• 6216964 Fix use-after-free in GTK4 clipboard read on timeout

File Changes

(1 file)

• M src/gui_gtk4.c (31)

Patch Links:

• https://github.com/vim/vim/pull/20467.patch
• https://github.com/vim/vim/pull/20467.diff

—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.Message ID: <vim/vim/pull/20467@github.com>