File _service:tar_scm:backport-CVE-2022-4292.patch of Package vim

File _service:tar_scm:backport-CVE-2022-4292.patch of Package vim (Revision 58b04dd6bb5949a2a336299cb4fd0db2)

Currently displaying revision 58b04dd6bb5949a2a336299cb4fd0db2 , Show latest

From c3d27ada14acd02db357f2d16347acc22cb17e93 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Mon, 14 Nov 2022 20:52:14 +0000
Subject: [PATCH] patch 9.0.0882: using freed memory after SpellFileMissing
 autocmd uses bwipe

Problem:    Using freed memory after SpellFileMissing autocmd uses bwipe.
Solution:   Bail out if the window no longer exists.
---
 src/spell.c                |  4 ++--
 src/testdir/test_spell.vim | 13 +++++++++++++
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/spell.c b/src/spell.c
index 3664425..d204a95 100644
--- a/src/spell.c
+++ b/src/spell.c
@@ -2101,8 +2101,8 @@ did_set_spelllang(win_T *wp)
 	    {
 		spell_load_lang(lang);
 		// SpellFileMissing autocommands may do anything, including
-		// destroying the buffer we are using...
-		if (!bufref_valid(&bufref))
+		// destroying the buffer we are using or closing the window.
+		if (!bufref_valid(&bufref) || !win_valid_any_tab(wp))
 		{
 		    ret_msg = N_(e_spellfilemising_autocommand_deleted_buffer);
 		    goto theend;
diff --git a/src/testdir/test_spell.vim b/src/testdir/test_spell.vim
index bc948b0..33f0931 100644
--- a/src/testdir/test_spell.vim
+++ b/src/testdir/test_spell.vim
@@ -157,6 +157,19 @@ func Test_spell_file_missing()
   %bwipe!
 endfunc
 
+func Test_spell_file_missing_bwipe()
+  " this was using a window that was wiped out in a SpellFileMissing autocmd
+  set spelllang=xy
+  au SpellFileMissing * n0
+  set spell
+  au SpellFileMissing * bw
+  snext somefile
+
+  au! SpellFileMissing
+  bwipe!
+  set nospell spelllang=en
+endfunc
+
 func Test_spelldump()
   " In case the spell file is not found avoid getting the download dialog, we
   " would get stuck at the prompt.
-- 
2.33.0