GitHub/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim synced 2025-07-16 01:01:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.1.0647: [security] use-after-free in tagstack_clear_entry

Browse Source 
Problem:  [security] use-after-free in tagstack_clear_entry
          (Suyue Guo )
Solution: Instead of manually calling vim_free() on each of the tagstack
          entries, let's use tagstack_clear_entry(), which will
          also free the stack, but using the VIM_CLEAR macro,
          which prevents a use-after-free by setting those pointers
          to NULL

This addresses CVE-2024-41957

Github advisory:
https://github.com/vim/vim/security/advisories/GHSA-f9cr-gv85-hcr4

8a0bbe7b8a

Co-authored-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
zeertzjq
2024-08-02 06:00:02 +08:00
parent a4bec30b7b
commit 6af359ef4c
4 changed files with 27 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/nvim/window.c
View File

@ -73,6 +73,7 @@
#include "nvim/statusline.h"
#include "nvim/strings.h"
#include "nvim/syntax.h"
#include "nvim/tag.h"
#include "nvim/terminal.h"
#include "nvim/types_defs.h"
#include "nvim/ui.h"
@ -5205,8 +5206,7 @@ void win_free(win_T *wp, tabpage_T *tp)
xfree(wp->w_lines);
for (int i = 0; i < wp->w_tagstacklen; i++) {
xfree(wp->w_tagstack[i].tagname);
xfree(wp->w_tagstack[i].user_data);
tagstack_clear_entry(&wp->w_tagstack[i]);
}
xfree(wp->w_localdir);