74 lines
2.1 KiB
Diff
74 lines
2.1 KiB
Diff
From 1c3dd8ddcba63c1af5112e567215b3cec2de11d0 Mon Sep 17 00:00:00 2001
|
||
From: Bram Moolenaar <Bram@vim.org>
|
||
Date: Sat, 17 Sep 2022 19:43:23 +0100
|
||
Subject: [PATCH] patch 9.0.0490: using freed memory with cmdwin and BufEnter
|
||
autocmd
|
||
|
||
Problem: Using freed memory with cmdwin and BufEnter autocmd.
|
||
Solution: Make sure pointer to b_p_iminsert is still valid.
|
||
---
|
||
src/ex_getln.c | 6 +++++-
|
||
src/testdir/test_cmdline.vim | 10 ++++++++++
|
||
2 files changed, 15 insertions(+), 1 deletion(-)
|
||
|
||
diff --git a/src/ex_getln.c b/src/ex_getln.c
|
||
index 8383eee..b299bd0 100644
|
||
--- a/src/ex_getln.c
|
||
+++ b/src/ex_getln.c
|
||
@@ -817,6 +817,7 @@ getcmdline_int(
|
||
#endif
|
||
expand_T xpc;
|
||
long *b_im_ptr = NULL;
|
||
+ buf_T *b_im_ptr_buf = NULL; // buffer where b_im_ptr is valid
|
||
cmdline_info_T save_ccline;
|
||
int did_save_ccline = FALSE;
|
||
int cmdline_type;
|
||
@@ -938,6 +939,7 @@ getcmdline_int(
|
||
b_im_ptr = &curbuf->b_p_iminsert;
|
||
else
|
||
b_im_ptr = &curbuf->b_p_imsearch;
|
||
+ b_im_ptr_buf = curbuf;
|
||
if (*b_im_ptr == B_IMODE_LMAP)
|
||
State |= LANGMAP;
|
||
#ifdef HAVE_INPUT_METHOD
|
||
@@ -1666,6 +1668,7 @@ getcmdline_int(
|
||
goto cmdline_not_changed;
|
||
|
||
case Ctrl_HAT:
|
||
+ b_im_ptr = buf_valid(b_im_ptr_buf) ? b_im_ptr : NULL;
|
||
if (map_to_exists_mode((char_u *)"", LANGMAP, FALSE))
|
||
{
|
||
// ":lmap" mappings exists, toggle use of mappings.
|
||
@@ -2430,7 +2433,8 @@ returncmd:
|
||
|
||
State = save_State;
|
||
#ifdef HAVE_INPUT_METHOD
|
||
- if (b_im_ptr != NULL && *b_im_ptr != B_IMODE_LMAP)
|
||
+ if (b_im_ptr != NULL && buf_valid(b_im_ptr_buf)
|
||
+ && *b_im_ptr != B_IMODE_LMAP)
|
||
im_save_status(b_im_ptr);
|
||
im_set_active(FALSE);
|
||
#endif
|
||
diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
|
||
index 68852a7..c442d7f 100644
|
||
--- a/src/testdir/test_cmdline.vim
|
||
+++ b/src/testdir/test_cmdline.vim
|
||
@@ -952,4 +952,14 @@ func Test_cmdline_expand_special()
|
||
call assert_fails('e <amatch>', 'E497:')
|
||
endfunc
|
||
|
||
+" This was using a pointer to a freed buffer
|
||
+func Test_cmdwin_freed_buffer_ptr()
|
||
+ au BufEnter * next 0| file
|
||
+ edit 0
|
||
+ silent! norm q/
|
||
+
|
||
+ au! BufEnter
|
||
+ bwipe!
|
||
+endfunc
|
||
+
|
||
" vim: shiftwidth=2 sts=2 expandtab
|
||
--
|
||
2.27.0
|
||
|