GitHub/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim synced 2025-07-16 01:01:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.1.1375: [security]: possible heap UAF with quickfix dummy buffer

Browse Source 
Problem:  heap use-after-free possible when autocommands switch away from the
          quickfix dummy buffer, but leave it open in a window.
Solution: close its windows first before attempting the wipe.
          (Sean Dewar)

related: vim/vim#17283

b4074ead5c

Co-authored-by: Sean Dewar <6256228+seandewar@users.noreply.github.com>
This commit is contained in:
Sean Dewar
2025-05-10 16:24:43 +01:00
parent 4b3a9ac413
commit 05dab80d8d
2 changed files with 37 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
src/nvim/quickfix.c
View File

@ -5948,7 +5948,9 @@ static buf_T *load_dummy_buffer(char *fname, char *dirname_start, char *resultin
aucmd_restbuf(&aco);
if (newbuf_to_wipe.br_buf != NULL && bufref_valid(&newbuf_to_wipe)) {
wipe_buffer(newbuf_to_wipe.br_buf, false);
block_autocmds();
wipe_dummy_buffer(newbuf_to_wipe.br_buf, NULL);
unblock_autocmds();
}
// Add back the "dummy" flag, otherwise buflist_findname_file_id()
@ -5972,11 +5974,11 @@ static buf_T *load_dummy_buffer(char *fname, char *dirname_start, char *resultin
return newbuf;
}
// Wipe out the dummy buffer that load_dummy_buffer() created. Restores
// directory to "dirname_start" prior to returning, if autocmds or the
// 'autochdir' option have changed it.
/// Wipe out the dummy buffer that load_dummy_buffer() created. Restores
/// directory to "dirname_start" if not NULL prior to returning, if autocmds or
/// the 'autochdir' option have changed it.
static void wipe_dummy_buffer(buf_T *buf, char *dirname_start)
FUNC_ATTR_NONNULL_ALL
FUNC_ATTR_NONNULL_ARG(1)
{
// If any autocommand opened a window on the dummy buffer, close that
// window. If we can't close them all then give up.
@ -6011,14 +6013,17 @@ static void wipe_dummy_buffer(buf_T *buf, char *dirname_start)
// Restore the error/interrupt/exception state if not discarded by a
// new aborting error, interrupt, or uncaught exception.
leave_cleanup(&cs);
// When autocommands/'autochdir' option changed directory: go back.
restore_start_dir(dirname_start);
if (dirname_start != NULL) {
// When autocommands/'autochdir' option changed directory: go back.
restore_start_dir(dirname_start);
}
}
}
// Unload the dummy buffer that load_dummy_buffer() created. Restores
// directory to "dirname_start" prior to returning, if autocmds or the
// 'autochdir' option have changed it.
/// Unload the dummy buffer that load_dummy_buffer() created. Restores
/// directory to "dirname_start" prior to returning, if autocmds or the
/// 'autochdir' option have changed it.
static void unload_dummy_buffer(buf_T *buf, char *dirname_start)
{
if (curbuf == buf) { // safety check

22
test/old/testdir/test_quickfix.vim
View File

@ -6777,4 +6777,26 @@ func Test_quickfix_close_buffer_crash()
wincmd q
endfunc
func Test_vimgrep_dummy_buffer_crash()
augroup DummyCrash
autocmd!
" Make the dummy buffer non-current, but still open in a window.
autocmd BufReadCmd * ++once let s:dummy_buf = bufnr()
\| split | wincmd p | enew
" Autocmds from cleaning up the dummy buffer in this case should be blocked.
autocmd BufWipeout *
\ call assert_notequal(s:dummy_buf, str2nr(expand('<abuf>')))
augroup END
silent! vimgrep /./ .
redraw! " Window to freed dummy buffer used to remain; heap UAF.
call assert_equal([], win_findbuf(s:dummy_buf))
call assert_equal(0, bufexists(s:dummy_buf))
unlet! s:dummy_buf
autocmd! DummyCrash
%bw!
endfunc
" vim: shiftwidth=2 sts=2 expandtab