To: vim_dev@googlegroups.com
Subject: Patch 8.1.2136
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 8.1.2136
Problem:    using freed memory with autocmd from fuzzer. (Dhiraj Mishra,
            Dominique Pelle)
Solution:   Avoid using "wp" after autocommands. (closes #5041)
Files:	    src/window.c, src/testdir/test_autocmd.vim


*** ../vim-8.1.2135/src/window.c	2019-10-07 22:38:54.816029419 +0200
--- src/window.c	2019-10-11 21:16:13.170482931 +0200
***************
*** 4641,4646 ****
--- 4641,4647 ----
  #ifdef FEAT_JOB_CHANNEL
      entering_window(curwin);
  #endif
+     // Careful: autocommands may close the window and make "wp" invalid
      if (trigger_new_autocmds)
  	apply_autocmds(EVENT_WINNEW, NULL, NULL, FALSE, curbuf);
      if (trigger_enter_autocmds)
***************
*** 4655,4661 ****
  #endif
      curwin->w_redr_status = TRUE;
  #ifdef FEAT_TERMINAL
!     if (bt_terminal(wp->w_buffer))
  	// terminal is likely in another mode
  	redraw_mode = TRUE;
  #endif
--- 4656,4662 ----
  #endif
      curwin->w_redr_status = TRUE;
  #ifdef FEAT_TERMINAL
!     if (bt_terminal(curwin->w_buffer))
  	// terminal is likely in another mode
  	redraw_mode = TRUE;
  #endif
*** ../vim-8.1.2135/src/testdir/test_autocmd.vim	2019-10-01 17:38:46.480054071 +0200
--- src/testdir/test_autocmd.vim	2019-10-11 21:14:08.006839516 +0200
***************
*** 2288,2290 ****
--- 2288,2298 ----
    call StopVimInTerminal(buf)
    call delete(filename)
  endfunc
+ 
+ func Test_autocmd_was_using_freed_memory()
+   pedit xx
+   n x
+   au WinEnter * quit
+   split
+   au! WinEnter
+ endfunc
*** ../vim-8.1.2135/src/version.c	2019-10-10 21:49:24.974264458 +0200
--- src/version.c	2019-10-11 21:17:02.842333402 +0200
***************
*** 755,756 ****
--- 755,758 ----
  {   /* Add new patch number below this line */
+ /**/
+     2136,
  /**/

-- 
Q: Why does /dev/null accept only integers?
A: You can't sink a float.

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\  an exciting new programming language -- http://www.Zimbu.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///