76 lines
2.1 KiB
Diff
76 lines
2.1 KiB
Diff
|
From 1c3dd8ddcba63c1af5112e567215b3cec2de11d0 Mon Sep 17 00:00:00 2001
|
|||
|
|
From: Bram Moolenaar <Bram@vim.org>
|
|||
|
|
Date: Sat, 17 Sep 2022 19:43:23 +0100
|
|||
|
|
Subject: [PATCH] patch 9.0.0490: using freed memory with cmdwin and BufEnter
|
|||
|
|
autocmd
|
|||
|
|
|
|||
|
|
Problem: Using freed memory with cmdwin and BufEnter autocmd.
|
|||
|
|
Solution: Make sure pointer to b_p_iminsert is still valid.
|
|||
|
|
---
|
|||
|
|
src/ex_getln.c | 8 ++++++--
|
|||
|
|
src/testdir/test_cmdline.vim | 10 ++++++++++
|
|||
|
|
2 files changed, 16 insertions(+), 2 deletions(-)
|
|||
|
|
|
|||
|
|
diff --git a/src/ex_getln.c b/src/ex_getln.c
|
|||
|
|
index 8dc03dc..535bfb5 100644
|
|||
|
|
--- a/src/ex_getln.c
|
|||
|
|
+++ b/src/ex_getln.c
|
|||
|
|
@@ -1607,6 +1607,7 @@ getcmdline_int(
|
|||
|
|
#endif
|
|||
|
|
expand_T xpc;
|
|||
|
|
long *b_im_ptr = NULL;
|
|||
|
|
+ buf_T *b_im_ptr_buf = NULL; // buffer where b_im_ptr is valid
|
|||
|
|
cmdline_info_T save_ccline;
|
|||
|
|
int did_save_ccline = FALSE;
|
|||
|
|
int cmdline_type;
|
|||
|
|
@@ -1703,6 +1704,7 @@ getcmdline_int(
|
|||
|
|
b_im_ptr = &curbuf->b_p_iminsert;
|
|||
|
|
else
|
|||
|
|
b_im_ptr = &curbuf->b_p_imsearch;
|
|||
|
|
+ b_im_ptr_buf = curbuf;
|
|||
|
|
if (*b_im_ptr == B_IMODE_LMAP)
|
|||
|
|
State |= MODE_LANGMAP;
|
|||
|
|
#ifdef HAVE_INPUT_METHOD
|
|||
|
|
@@ -2060,7 +2062,8 @@ getcmdline_int(
|
|||
|
|
goto cmdline_not_changed;
|
|||
|
|
|
|||
|
|
case Ctrl_HAT:
|
|||
|
|
- cmdline_toggle_langmap(b_im_ptr);
|
|||
|
|
+ cmdline_toggle_langmap(
|
|||
|
|
+ buf_valid(b_im_ptr_buf) ? b_im_ptr : NULL);
|
|||
|
|
goto cmdline_not_changed;
|
|||
|
|
|
|||
|
|
// case '@': only in very old vi
|
|||
|
|
@@ -2573,7 +2576,8 @@ returncmd:
|
|||
|
|
#endif
|
|||
|
|
|
|||
|
|
#ifdef HAVE_INPUT_METHOD
|
|||
|
|
- if (b_im_ptr != NULL && *b_im_ptr != B_IMODE_LMAP)
|
|||
|
|
+ if (b_im_ptr != NULL && buf_valid(b_im_ptr_buf)
|
|||
|
|
+ && *b_im_ptr != B_IMODE_LMAP)
|
|||
|
|
im_save_status(b_im_ptr);
|
|||
|
|
im_set_active(FALSE);
|
|||
|
|
#endif
|
|||
|
|
diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
|
|||
|
|
index 08e2de7..440df96 100644
|
|||
|
|
--- a/src/testdir/test_cmdline.vim
|
|||
|
|
+++ b/src/testdir/test_cmdline.vim
|
|||
|
|
@@ -3447,4 +3447,14 @@ func Test_cmdwin_virtual_edit()
|
|||
|
|
set ve= cpo-=$
|
|||
|
|
endfunc
|
|||
|
|
|
|||
|
|
+" This was using a pointer to a freed buffer
|
|||
|
|
+func Test_cmdwin_freed_buffer_ptr()
|
|||
|
|
+ au BufEnter * next 0| file
|
|||
|
|
+ edit 0
|
|||
|
|
+ silent! norm q/
|
|||
|
|
+
|
|||
|
|
+ au! BufEnter
|
|||
|
|
+ bwipe!
|
|||
|
|
+endfunc
|
|||
|
|
+
|
|||
|
|
" vim: shiftwidth=2 sts=2 expandtab
|
|||
|
|
--
|
|||
|
|
2.27.0
|
|||
|
|
|