File _service:tar_scm:backport-CVE-2022-3705.patch of Package vim

File _service:tar_scm:backport-CVE-2022-3705.patch of Package vim (Revision e92806e7dd275bb74c1216717291a331)

Currently displaying revision e92806e7dd275bb74c1216717291a331 , Show latest

From d0fab10ed2a86698937e3c3fed2f10bd9bb5e731 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Thu, 20 Oct 2022 16:03:33 +0100
Subject: [PATCH] patch 9.0.0805: filetype autocmd may cause freed memory
 access

Problem:    Filetype autocmd may cause freed memory access.
Solution:   Set the quickfix-busy flag while filling the buffer.
---
 src/quickfix.c                |  6 ++++++
 src/testdir/test_quickfix.vim | 16 ++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/src/quickfix.c b/src/quickfix.c
index a90611475ab1..f85fff56f23d 100644
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -4543,6 +4543,9 @@ qf_update_buffer(qf_info_T *qi, qfline_T *old_last)
 	    qf_winid = win->w_id;
 	}
 
+	// autocommands may cause trouble
+	incr_quickfix_busy();
+
 	if (old_last == NULL)
 	    // set curwin/curbuf to buf and save a few things
 	    aucmd_prepbuf(&aco, buf);
@@ -4564,6 +4567,9 @@ qf_update_buffer(qf_info_T *qi, qfline_T *old_last)
 	// when the added lines are not visible.
 	if ((win = qf_find_win(qi)) != NULL && old_line_count < win->w_botline)
 	    redraw_buf_later(buf, NOT_VALID);
+
+	// always called after incr_quickfix_busy()
+	decr_quickfix_busy();
     }
 }
 
diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
index 2ee754b39690..bcaef5da175c 100644
--- a/src/testdir/test_quickfix.vim
+++ b/src/testdir/test_quickfix.vim
@@ -3471,6 +3471,21 @@ func Test_resize_from_copen()
   endtry
 endfunc
 
+func Test_filetype_autocmd()
+  " this changes the location list while it is in use to fill a buffer
+  lexpr ''
+  lopen
+  augroup FT_loclist
+    au FileType * call setloclist(0, [], 'f')
+  augroup END
+  silent! lolder
+  lexpr ''
+
+  augroup FT_loclist
+    au! FileType
+  augroup END
+endfunc
+
 func Test_vimgrep_with_textlock()
   new
 
@@ -6380,4 +6395,5 @@ func Test_loclist_replace_autocmd()
   call setloclist(0, [], 'f')
 endfunc
 
+
 " vim: shiftwidth=2 sts=2 expandtab
-- 
2.33.0