Skip to content

Commit ec66c41

Browse files
committed
patch 8.1.2136: using freed memory with autocmd from fuzzer
Problem: using freed memory with autocmd from fuzzer. (Dhiraj Mishra, Dominique Pelle) Solution: Avoid using "wp" after autocommands. (closes #5041)
1 parent 00eab7f commit ec66c41

File tree

3 files changed

+12
-1
lines changed

3 files changed

+12
-1
lines changed

Diff for: src/testdir/test_autocmd.vim

+8
Original file line numberDiff line numberDiff line change
@@ -2288,3 +2288,11 @@ func Test_autocmd_CmdWinEnter()
22882288
call StopVimInTerminal(buf)
22892289
call delete(filename)
22902290
endfunc
2291+
2292+
func Test_autocmd_was_using_freed_memory()
2293+
pedit xx
2294+
n x
2295+
au WinEnter * quit
2296+
split
2297+
au! WinEnter
2298+
endfunc

Diff for: src/version.c

+2
Original file line numberDiff line numberDiff line change
@@ -753,6 +753,8 @@ static char *(features[]) =
753753

754754
static int included_patches[] =
755755
{ /* Add new patch number below this line */
756+
/**/
757+
2136,
756758
/**/
757759
2135,
758760
/**/

Diff for: src/window.c

+2-1
Original file line numberDiff line numberDiff line change
@@ -4641,6 +4641,7 @@ win_enter_ext(
46414641
#ifdef FEAT_JOB_CHANNEL
46424642
entering_window(curwin);
46434643
#endif
4644+
// Careful: autocommands may close the window and make "wp" invalid
46444645
if (trigger_new_autocmds)
46454646
apply_autocmds(EVENT_WINNEW, NULL, NULL, FALSE, curbuf);
46464647
if (trigger_enter_autocmds)
@@ -4655,7 +4656,7 @@ win_enter_ext(
46554656
#endif
46564657
curwin->w_redr_status = TRUE;
46574658
#ifdef FEAT_TERMINAL
4658-
if (bt_terminal(wp->w_buffer))
4659+
if (bt_terminal(curwin->w_buffer))
46594660
// terminal is likely in another mode
46604661
redraw_mode = TRUE;
46614662
#endif

0 commit comments

Comments
 (0)