[vim/vim] win_splitmove UAF if win_split_ins autocommands delete "wp" (PR #14078)

[Sean Dewar]

Problem: heap-use-after-free in win_splitmove if Enter/Leave autocommands from
win_split_ins immediately closes "wp".

Solution: check that "wp" is valid after win_split_ins.

(This one's not a regression; just missed this possibility previously)

---

You can view, comment on, or merge this pull request online at:

  https://github.com/vim/vim/pull/14078

Commit Summary

• bbf7cdc win_splitmove UAF if win_split_ins autocommands delete "wp"

File Changes

(2 files)

• M src/testdir/test_window_cmd.vim (9)
• M src/window.c (3)

Patch Links:

• https://github.com/vim/vim/pull/14078.patch
• https://github.com/vim/vim/pull/14078.diff

—
Reply to this email directly, view it on GitHub.
You are receiving this because you are subscribed to this thread.Message ID: <vim/vim/pull/14078@github.com>

[Christian Brabandt]

thanks for that. Makes sense of course.

—
Reply to this email directly, view it on GitHub.

You are receiving this because you are subscribed to this thread.Message ID: <vim/vim/pull/14078/c1962308148@github.com>

[Christian Brabandt]

Closed #14078 via abf7030.

—
Reply to this email directly, view it on GitHub.

You are receiving this because you are subscribed to this thread.Message ID: <vim/vim/pull/14078/issue_event/11910418037@github.com>