From 5618b9e49cb3fbe0e48962c4e746e0299ebb48af Mon Sep 17 00:00:00 2001
From: Christian Brabandt <cb@256bit.org>
Date: Sun, 6 Oct 2024 17:31:10 +0200
Subject: [PATCH] patch 9.1.0764: [security]: use-after-free when closing a
 buffer

Problem:  [security]: use-after-free when closing a buffer
Solution: When splitting the window and editing a new buffer,
          check whether the newly to be edited buffer has been marked
          for deletion and abort in this case

Github Advisory:
https://github.com/vim/vim/security/advisories/GHSA-rj48-v4mq-j4vg

Signed-off-by: Christian Brabandt <cb@256bit.org>
---
 src/buffer.c                 |  6 ++++++
 src/ex_cmds.c                | 12 ++++++++++++
 src/proto/buffer.pro         |  1 +
 3 files changed, 19 insertions(+)

diff --git a/src/buffer.c b/src/buffer.c
index 95193a006..70c70c759 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -496,6 +496,12 @@ can_unload_buffer(buf_T *buf)
     return can_unload;
 }
 
+    int
+buf_locked(buf_T *buf)
+{
+    return buf->b_locked || buf->b_locked_split;
+}
+
 /*
  * Close the link to a buffer.
  * "action" is used when there is no longer a window for the buffer.
diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index 46c4503d0..31cef2a7c 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -2740,6 +2740,18 @@ do_ecmd(
 	}
 	if (buf == NULL)
 	    goto theend;
+	// autocommands try to edit a file that is goind to be removed,
+	// abort
+	if (buf_locked(buf))
+	{
+	    // window was split, but not editing the new buffer,
+	    // reset b_nwindows again
+	    if (oldwin == NULL
+		    && curwin->w_buffer != NULL
+		    && curwin->w_buffer->b_nwindows > 1)
+		--curwin->w_buffer->b_nwindows;
+	    goto theend;
+	}
 	if (curwin->w_alt_fnum == buf->b_fnum && prev_alt_fnum != 0)
 	    // reusing the buffer, keep the old alternate file
 	    curwin->w_alt_fnum = prev_alt_fnum;
diff --git a/src/proto/buffer.pro b/src/proto/buffer.pro
index 3a6102789..dc68ca8fc 100644
--- a/src/proto/buffer.pro
+++ b/src/proto/buffer.pro
@@ -70,4 +70,5 @@ char_u *buf_get_fname(buf_T *buf);
 void set_buflisted(int on);
 int buf_contents_changed(buf_T *buf);
 void wipe_buffer(buf_T *buf, int aucmd);
+int buf_locked(buf_T *buf);
 /* vim: set ft=c : */
-- 
2.41.1