[vim/vim] patch 9.2.XXXX: heap-use-after-free in ml_open_file() (PR #21171)

[Christian Brabandt]

Problem: A SwapExists autocmd can re-open the buffer being edited,
causing ml_close() to free the memfile that
ml_open_file() still holds a local pointer to, causing
use-after-free.
Solution: After findswapname() returns, verify that buf->b_ml.ml_mfp
is still the same as the copy mfp we hold.

No tests, because I couldn't figure it out :(

---

You can view, comment on, or merge this pull request online at:

  https://github.com/vim/vim/pull/21171

Commit Summary

• 0493e88 patch 9.2.XXXX: heap-use-after-free in ml_open_file()

File Changes

(1 file)

• M src/memline.c (6)

Patch Links:

• https://github.com/vim/vim/pull/21171.patch
• https://github.com/vim/vim/pull/21171.diff

—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.Message ID: <vim/vim/pull/21171@github.com>