From: Bram Moolenaar <Bram@vim.org>
Date: Mon, 4 Oct 2021 22:13:13 +0000 (+0100)
Subject: patch 8.2.3476: renaming a buffer on startup may cause using freed memory
X-Git-Tag: v8.2.3476
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d3710cf01ef6ab1b2f233866ff01dab76686f642;p=vim

patch 8.2.3476: renaming a buffer on startup may cause using freed memory

Problem:    Renaming a buffer on startup may cause using freed memory.
Solution:   Check if the buffer is used in a window. (closes #8955)
---

diff --git a/src/buffer.c b/src/buffer.c
index 5616487da..bcbdf839d 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -3399,7 +3399,17 @@ setfname(
 #endif
 	if (obuf != NULL && obuf != buf)
 	{
-	    if (obuf->b_ml.ml_mfp != NULL)	// it's loaded, fail
+	    win_T	*win;
+	    tabpage_T   *tab;
+	    int		in_use = FALSE;
+
+	    // during startup a window may use a buffer that is not loaded yet
+	    FOR_ALL_TAB_WINDOWS(tab, win)
+		if (win->w_buffer == obuf)
+		    in_use = TRUE;
+
+	    // it's loaded or used in a window, fail
+	    if (obuf->b_ml.ml_mfp != NULL || in_use)
 	    {
 		if (message)
 		    emsg(_("E95: Buffer with this name already exists"));
diff --git a/src/testdir/test_startup.vim b/src/testdir/test_startup.vim
index 6b64adf74..897492deb 100644
--- a/src/testdir/test_startup.vim
+++ b/src/testdir/test_startup.vim
@@ -1296,4 +1296,18 @@ func Test_echo_true_in_cmd()
   call delete('Xresult')
 endfunc
 
+func Test_rename_buffer_on_startup()
+  let lines =<< trim END
+      call writefile(['done'], 'Xresult')
+      qa!
+  END
+  call writefile(lines, 'Xscript')
+  if RunVim([], [], "--clean -e -s --cmd 'file x|new|file x' --cmd 'so Xscript'")
+    call assert_equal(['done'], readfile('Xresult'))
+  endif
+  call delete('Xscript')
+  call delete('Xresult')
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index e6a4b1ad5..95200c666 100644
--- a/src/version.c
+++ b/src/version.c
@@ -757,6 +757,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    3476,
 /**/
     3475,
 /**/