From: Bram Moolenaar <Bram@vim.org>
Date: Mon, 18 Dec 2017 14:33:00 +0000 (+0100)
Subject: patch 8.0.1403: using freed buffer in grep command
X-Git-Tag: v8.0.1403
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=4fb921e388b9a042573ab06cce36e92874954197;p=vim

patch 8.0.1403: using freed buffer in grep command

Problem:    Using freed buffer in grep command. (gy741, Dominique Pelle)
Solution:   Lock the dummy buffer to avoid autocommands wiping it out.
---

diff --git a/src/quickfix.c b/src/quickfix.c
index 70522fa62..6817aa726 100644
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -4572,6 +4572,7 @@ load_dummy_buffer(
     bufref_T	newbuf_to_wipe;
     int		failed = TRUE;
     aco_save_T	aco;
+    int		readfile_result;
 
     /* Allocate a buffer without putting it in the buffer list. */
     newbuf = buflist_new(NULL, NULL, (linenr_T)1, BLN_DUMMY);
@@ -4585,6 +4586,9 @@ load_dummy_buffer(
     /* need to open the memfile before putting the buffer in a window */
     if (ml_open(newbuf) == OK)
     {
+	/* Make sure this buffer isn't wiped out by auto commands. */
+	++newbuf->b_locked;
+
 	/* set curwin/curbuf to buf and save a few things */
 	aucmd_prepbuf(&aco, newbuf);
 
@@ -4599,9 +4603,11 @@ load_dummy_buffer(
 	curbuf->b_flags &= ~BF_DUMMY;
 
 	newbuf_to_wipe.br_buf = NULL;
-	if (readfile(fname, NULL,
+	readfile_result = readfile(fname, NULL,
 		    (linenr_T)0, (linenr_T)0, (linenr_T)MAXLNUM,
-		    NULL, READ_NEW | READ_DUMMY) == OK
+		    NULL, READ_NEW | READ_DUMMY);
+	--newbuf->b_locked;
+	if (readfile_result == OK
 		&& !got_int
 		&& !(curbuf->b_flags & BF_NEW))
 	{
diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
index 8ac881107..d8fddffeb 100644
--- a/src/testdir/test_autocmd.vim
+++ b/src/testdir/test_autocmd.vim
@@ -1171,3 +1171,10 @@ func Test_nocatch_wipe_all_buffers()
   bwipe
   au!
 endfunc
+
+func Test_nocatch_wipe_dummy_buffer()
+  " Nasty autocommand: wipe buffer on any event.
+  au * x bwipe
+  call assert_fails('lv½ /x', 'E480')
+  au!
+endfunc
diff --git a/src/version.c b/src/version.c
index fc2eda65e..1ce42a91d 100644
--- a/src/version.c
+++ b/src/version.c
@@ -771,6 +771,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1403,
 /**/
     1402,
 /**/