Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix heap-use-after-free when using synstack() and synID() in WinEnter #10204

Closed
wants to merge 1 commit into from

Conversation

zeertzjq
Copy link
Member

@zeertzjq zeertzjq commented Apr 16, 2022

This causes heap-use-after-free:

autocmd WinEnter * call synstack(line("."), col("."))
autocmd WinEnter * call synID(line('.'), col('.') - 1, 1)
call setline(1, 'aaaaa')
normal! $
new
close

Adding a wp != syn_win seems to fix this.

@codecov
Copy link

codecov bot commented Apr 16, 2022

Codecov Report

Merging #10204 (a5a033f) into master (092e09c) will increase coverage by 0.00%.
The diff coverage is 100.00%.

@@           Coverage Diff           @@
##           master   #10204   +/-   ##
=======================================
  Coverage   81.98%   81.98%           
=======================================
  Files         167      167           
  Lines      187956   187957    +1     
  Branches    42381    42381           
=======================================
+ Hits       154087   154091    +4     
+ Misses      21521    21518    -3     
  Partials    12348    12348           
Flag Coverage Δ
huge-clang-none 82.40% <100.00%> (+<0.01%) ⬆️
huge-gcc-none 82.74% <100.00%> (+<0.01%) ⬆️
huge-gcc-testgui 81.20% <100.00%> (+<0.01%) ⬆️
huge-gcc-unittests 2.00% <0.00%> (-0.01%) ⬇️
linux 83.98% <100.00%> (+<0.01%) ⬆️
mingw-x64-HUGE 0.00% <0.00%> (ø)
mingw-x64-HUGE-gui 77.19% <100.00%> (+<0.01%) ⬆️
windows 75.98% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
src/syntax.c 79.72% <100.00%> (+<0.01%) ⬆️
src/gui_gtk_x11.c 56.97% <0.00%> (-0.10%) ⬇️
src/netbeans.c 73.11% <0.00%> (-0.08%) ⬇️
src/channel.c 83.94% <0.00%> (-0.05%) ⬇️
src/terminal.c 78.43% <0.00%> (+0.02%) ⬆️
src/window.c 88.45% <0.00%> (+0.06%) ⬆️
src/os_win32.c 57.14% <0.00%> (+0.10%) ⬆️
src/ui.c 75.72% <0.00%> (+0.26%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 092e09c...a5a033f. Read the comment docs.

@brammool brammool closed this in ca7e86c Apr 16, 2022
@zeertzjq zeertzjq deleted the fix-syntax-use-after-free branch April 16, 2022 18:40
zeertzjq added a commit to zeertzjq/neovim that referenced this pull request Apr 16, 2022
…n WinEnter

Problem:    Using freed memory when using synstack() and synID() in WinEnter.
Solution:   Check using the syntax window. (closes vim/vim#10204)
vim/vim@ca7e86c
zeertzjq added a commit to neovim/neovim that referenced this pull request Apr 16, 2022
…n WinEnter (#18136)

Problem:    Using freed memory when using synstack() and synID() in WinEnter.
Solution:   Check using the syntax window. (closes vim/vim#10204)
vim/vim@ca7e86c
zeertzjq added a commit to zeertzjq/neovim that referenced this pull request Apr 17, 2022
…n WinEnter (neovim#18136)

Problem:    Using freed memory when using synstack() and synID() in WinEnter.
Solution:   Check using the syntax window. (closes vim/vim#10204)
vim/vim@ca7e86c
(cherry picked from commit dcf7bc4)
kraftwerk28 pushed a commit to kraftwerk28/neovim that referenced this pull request Jun 1, 2022
…n WinEnter (neovim#18136)

Problem:    Using freed memory when using synstack() and synID() in WinEnter.
Solution:   Check using the syntax window. (closes vim/vim#10204)
vim/vim@ca7e86c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant