From 58c3f916699592b97861425fde418a66256e2f1b Mon Sep 17 00:00:00 2001 From: xiaoliu458296371 <2186358949@qq.com> Date: Sun, 22 Dec 2024 21:29:29 +0800 Subject: [PATCH 1/4] 'CVE-2024-43374' --- src/arglist.c | 6 ++++++ src/buffer.c | 4 ++-- src/ex_cmds.c | 4 ++-- src/proto/window.pro | 2 ++ src/structs.h | 2 +- src/terminal.c | 2 +- src/testdir/test_arglist.vim | 24 ++++++++++++++++++++++++ src/version.c | 2 ++ src/window.c | 29 +++++++++++++++++++---------- 9 files changed, 59 insertions(+), 16 deletions(-) diff --git a/src/arglist.c b/src/arglist.c index d28b31d..6c30075 100644 --- a/src/arglist.c +++ b/src/arglist.c @@ -184,6 +184,8 @@ alist_set( /* * Add file "fname" to argument list "al". * "fname" must have been allocated and "al" must have been checked for room. + * + * May trigger Buf* autocommands */ void alist_add( @@ -196,6 +198,7 @@ alist_add( if (check_arglist_locked() == FAIL) return; arglist_locked = TRUE; + curwin->w_locked = TRUE; #ifdef BACKSLASH_IN_FILENAME slash_adjust(fname); @@ -207,6 +210,7 @@ alist_add( ++al->al_ga.ga_len; arglist_locked = FALSE; + curwin->w_locked = FALSE; } #if defined(BACKSLASH_IN_FILENAME) || defined(PROTO) @@ -365,6 +369,7 @@ alist_add_list( mch_memmove(&(ARGLIST[after + count]), &(ARGLIST[after]), (ARGCOUNT - after) * sizeof(aentry_T)); arglist_locked = TRUE; + curwin->w_locked = TRUE; for (i = 0; i < count; ++i) { int flags = BLN_LISTED | (will_edit ? BLN_CURBUF : 0); @@ -373,6 +378,7 @@ alist_add_list( ARGLIST[after + i].ae_fnum = buflist_add(files[i], flags); } arglist_locked = FALSE; + curwin->w_locked = FALSE; ALIST(curwin)->al_ga.ga_len += count; if (old_argcount > 0 && curwin->w_arg_idx >= after) curwin->w_arg_idx += count; diff --git a/src/buffer.c b/src/buffer.c index 64e4926..b0c2f2a 100644 --- a/src/buffer.c +++ b/src/buffer.c @@ -1451,7 +1451,7 @@ do_buffer_ext( // (unless it's the only window). Repeat this so long as we end up in // a window with this buffer. while (buf == curbuf - && !(curwin->w_closing || curwin->w_buffer->b_locked > 0) + && !(win_locked(curwin) || curwin->w_buffer->b_locked > 0) && (!ONE_WINDOW || first_tabpage->tp_next != NULL)) { if (win_close(curwin, FALSE) == FAIL) @@ -5438,7 +5438,7 @@ ex_buffer_all(exarg_T *eap) : wp->w_width != Columns) || (had_tab > 0 && wp != firstwin)) && !ONE_WINDOW - && !(wp->w_closing || wp->w_buffer->b_locked > 0) + && !(win_locked(wp) || wp->w_buffer->b_locked > 0) && !win_unlisted(wp)) { if (win_close(wp, FALSE) == FAIL) diff --git a/src/ex_cmds.c b/src/ex_cmds.c index d8e891c..87db66f 100644 --- a/src/ex_cmds.c +++ b/src/ex_cmds.c @@ -2827,7 +2827,7 @@ do_ecmd( // Set the w_closing flag to avoid that autocommands close the // window. And set b_locked for the same reason. - the_curwin->w_closing = TRUE; + the_curwin->w_locked = TRUE; ++buf->b_locked; if (curbuf == old_curbuf.br_buf) @@ -2841,7 +2841,7 @@ do_ecmd( // Autocommands may have closed the window. if (win_valid(the_curwin)) - the_curwin->w_closing = FALSE; + the_curwin->w_locked = FALSE; --buf->b_locked; #ifdef FEAT_EVAL diff --git a/src/proto/window.pro b/src/proto/window.pro index cfb771d..f8b0a72 100644 --- a/src/proto/window.pro +++ b/src/proto/window.pro @@ -93,4 +93,6 @@ int win_hasvertsplit(void); int get_win_number(win_T *wp, win_T *first_win); int get_tab_number(tabpage_T *tp); char *check_colorcolumn(win_T *wp); +int get_last_winid(void); +int win_locked(win_T *wp); /* vim: set ft=c : */ diff --git a/src/structs.h b/src/structs.h index 3b51e0c..91f1d17 100644 --- a/src/structs.h +++ b/src/structs.h @@ -3744,7 +3744,7 @@ struct window_S synblock_T *w_s; // for :ownsyntax #endif - int w_closing; // window is being closed, don't let + int w_locked; // window is being closed, don't let // autocommands close it too. frame_T *w_frame; // frame containing this window diff --git a/src/terminal.c b/src/terminal.c index a641a85..997b038 100644 --- a/src/terminal.c +++ b/src/terminal.c @@ -3669,7 +3669,7 @@ term_after_channel_closed(term_T *term) if (is_aucmd_win(curwin)) do_set_w_closing = TRUE; if (do_set_w_closing) - curwin->w_closing = TRUE; + curwin->w_locked = TRUE; do_bufdel(DOBUF_WIPE, (char_u *)"", 1, fnum, fnum, FALSE); if (do_set_w_closing) curwin->w_closing = FALSE; diff --git a/src/testdir/test_arglist.vim b/src/testdir/test_arglist.vim index edc8b77..4a5d86d 100644 --- a/src/testdir/test_arglist.vim +++ b/src/testdir/test_arglist.vim @@ -359,6 +359,7 @@ func Test_argv() call assert_equal('', argv(1, 100)) call assert_equal([], argv(-1, 100)) call assert_equal('', argv(10, -1)) + %argdelete endfunc " Test for the :argedit command @@ -744,4 +745,27 @@ func Test_all_command() %bw! endfunc +" Test for deleting buffer when creating an arglist. This was accessing freed +" memory +func Test_crash_arglist_uaf() + "%argdelete + new one + au BufAdd XUAFlocal :bw + "call assert_fails(':arglocal XUAFlocal', 'E163:') + arglocal XUAFlocal + au! BufAdd + bw! XUAFlocal + + au BufAdd XUAFlocal2 :bw + new two + new three + arglocal + argadd XUAFlocal2 Xfoobar + bw! XUAFlocal2 + bw! two + + au! BufAdd +endfunc + + " vim: shiftwidth=2 sts=2 expandtab diff --git a/src/version.c b/src/version.c index 2e178f3..f440140 100644 --- a/src/version.c +++ b/src/version.c @@ -704,6 +704,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 17, /**/ 16, /**/ diff --git a/src/window.c b/src/window.c index 54e17be..f7d423d 100644 --- a/src/window.c +++ b/src/window.c @@ -2441,7 +2441,7 @@ close_windows( for (wp = firstwin; wp != NULL && !ONE_WINDOW; ) { if (wp->w_buffer == buf && (!keep_curwin || wp != curwin) - && !(wp->w_closing || wp->w_buffer->b_locked > 0)) + && !(win_locked(wp) || wp->w_buffer->b_locked > 0)) { if (win_close(wp, FALSE) == FAIL) // If closing the window fails give up, to avoid looping @@ -2462,7 +2462,7 @@ close_windows( if (tp != curtab) FOR_ALL_WINDOWS_IN_TAB(tp, wp) if (wp->w_buffer == buf - && !(wp->w_closing || wp->w_buffer->b_locked > 0)) + && !(win_locked(wp) || wp->w_buffer->b_locked > 0)) { win_close_othertab(wp, FALSE, tp); @@ -2584,10 +2584,10 @@ win_close_buffer(win_T *win, int action, int abort_if_last) bufref_T bufref; set_bufref(&bufref, curbuf); - win->w_closing = TRUE; + win->w_locked = TRUE; close_buffer(win, win->w_buffer, action, abort_if_last, TRUE); if (win_valid_any_tab(win)) - win->w_closing = FALSE; + win->w_locked = FALSE; // Make sure curbuf is valid. It can become invalid if 'bufhidden' is // "wipe". if (!bufref_valid(&bufref)) @@ -2635,7 +2635,7 @@ win_close(win_T *win, int free_buf) if (window_layout_locked(CMD_close)) return FAIL; - if (win->w_closing || (win->w_buffer != NULL + if (win_locked(win) || (win->w_buffer != NULL && win->w_buffer->b_locked > 0)) return FAIL; // window is already being closed if (win_unlisted(win)) @@ -2684,19 +2684,19 @@ win_close(win_T *win, int free_buf) other_buffer = TRUE; if (!win_valid(win)) return FAIL; - win->w_closing = TRUE; + win->w_locked = TRUE; apply_autocmds(EVENT_BUFLEAVE, NULL, NULL, FALSE, curbuf); if (!win_valid(win)) return FAIL; - win->w_closing = FALSE; + win->w_locked = FALSE; if (last_window()) return FAIL; } - win->w_closing = TRUE; + win->w_locked = TRUE; apply_autocmds(EVENT_WINLEAVE, NULL, NULL, FALSE, curbuf); if (!win_valid(win)) return FAIL; - win->w_closing = FALSE; + win->w_locked = FALSE; if (last_window()) return FAIL; #ifdef FEAT_EVAL @@ -3269,7 +3269,7 @@ win_close_othertab(win_T *win, int free_buf, tabpage_T *tp) // Get here with win->w_buffer == NULL when win_close() detects the tab // page changed. - if (win->w_closing || (win->w_buffer != NULL + if (win_locked(win) || (win->w_buffer != NULL && win->w_buffer->b_locked > 0)) return; // window is already being closed @@ -7812,3 +7812,12 @@ skip: return NULL; // no error } #endif + +/* + * Don't let autocommands close the given window + */ + int +win_locked(win_T *wp) +{ + return wp->w_locked; +} -- Gitee From eac789517cdaa80fc9e356108e9d5d7787f6fce0 Mon Sep 17 00:00:00 2001 From: xiaoliu <2186358949@qq.com> Date: Fri, 27 Dec 2024 11:56:27 +0000 Subject: [PATCH 2/4] =?UTF-8?q?update=20src/proto/window.pro.=20=E5=B7=B2?= =?UTF-8?q?=E6=8C=89=E7=85=A7=E5=BB=BA=E8=AE=AE=E4=BF=AE=E6=94=B9?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: xiaoliu <2186358949@qq.com> --- src/proto/window.pro | 1 - 1 file changed, 1 deletion(-) diff --git a/src/proto/window.pro b/src/proto/window.pro index f8b0a72..12edf0b 100644 --- a/src/proto/window.pro +++ b/src/proto/window.pro @@ -93,6 +93,5 @@ int win_hasvertsplit(void); int get_win_number(win_T *wp, win_T *first_win); int get_tab_number(tabpage_T *tp); char *check_colorcolumn(win_T *wp); -int get_last_winid(void); int win_locked(win_T *wp); /* vim: set ft=c : */ -- Gitee From 8469d1f72b02800fd46a2df177cb3e638fb9af3b Mon Sep 17 00:00:00 2001 From: xiaoliu <2186358949@qq.com> Date: Fri, 3 Jan 2025 06:18:33 +0000 Subject: [PATCH 3/4] update src/terminal.c. Signed-off-by: xiaoliu <2186358949@qq.com> --- src/terminal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/terminal.c b/src/terminal.c index 997b038..b7ca2b5 100644 --- a/src/terminal.c +++ b/src/terminal.c @@ -3672,7 +3672,7 @@ term_after_channel_closed(term_T *term) curwin->w_locked = TRUE; do_bufdel(DOBUF_WIPE, (char_u *)"", 1, fnum, fnum, FALSE); if (do_set_w_closing) - curwin->w_closing = FALSE; + curwin->w_locked = FALSE; aucmd_restbuf(&aco); } #ifdef FEAT_PROP_POPUP -- Gitee From 6bf3c99b560d6b70024924b1d03fe99e89cd71cd Mon Sep 17 00:00:00 2001 From: xiaoliu <2186358949@qq.com> Date: Fri, 3 Jan 2025 06:22:49 +0000 Subject: [PATCH 4/4] update src/version.c. Signed-off-by: xiaoliu <2186358949@qq.com> --- src/version.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/version.c b/src/version.c index f440140..2e178f3 100644 --- a/src/version.c +++ b/src/version.c @@ -704,8 +704,6 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ -/**/ - 17, /**/ 16, /**/ -- Gitee