Skip to content

Commit

Permalink
Fix heap-use-after-free when using synstack() and synID() in WinEnter
Browse files Browse the repository at this point in the history
  • Loading branch information
zeertzjq committed Apr 16, 2022
1 parent 092e09c commit a5a033f
Show file tree
Hide file tree
Showing 2 changed files with 15 additions and 1 deletion.
3 changes: 2 additions & 1 deletion src/syntax.c
Original file line number Diff line number Diff line change
Expand Up @@ -6487,7 +6487,8 @@ syn_get_id(
{
// When the position is not after the current position and in the same
// line of the same buffer, need to restart parsing.
if (wp->w_buffer != syn_buf
if (wp != syn_win
|| wp->w_buffer != syn_buf
|| lnum != current_lnum
|| col < current_col)
syntax_start(wp, lnum);
Expand Down
13 changes: 13 additions & 0 deletions src/testdir/test_syntax.vim
Original file line number Diff line number Diff line change
Expand Up @@ -956,5 +956,18 @@ func Test_syn_include_contains_TOP()
bw!
endfunc

" This was using freed memory
func Test_WinEnter_synstack_synID()
autocmd WinEnter * call synstack(line("."), col("."))
autocmd WinEnter * call synID(line('.'), col('.') - 1, 1)
call setline(1, 'aaaaa')
normal! $
new
close

au! WinEnter
bw!
endfunc


" vim: shiftwidth=2 sts=2 expandtab

0 comments on commit a5a033f

Please sign in to comment.