Blame SOURCES/0001-patch-8.2.4281-using-freed-memory-with-lopen-and-bwi.patch

13ea7f
diff -up vim82/src/buffer.c.cve0443 vim82/src/buffer.c
13ea7f
--- vim82/src/buffer.c.cve0443	2021-03-22 10:02:42.000000000 +0100
13ea7f
+++ vim82/src/buffer.c	2022-02-10 08:33:19.159488384 +0100
13ea7f
@@ -1710,6 +1710,7 @@ set_curbuf(buf_T *buf, int action)
13ea7f
 #endif
13ea7f
     bufref_T	newbufref;
13ea7f
     bufref_T	prevbufref;
13ea7f
+    int		valid;
13ea7f
 
13ea7f
     setpcmark();
13ea7f
     if ((cmdmod.cmod_flags & CMOD_KEEPALT) == 0)
13ea7f
@@ -1763,13 +1764,19 @@ set_curbuf(buf_T *buf, int action)
13ea7f
     // An autocommand may have deleted "buf", already entered it (e.g., when
13ea7f
     // it did ":bunload") or aborted the script processing.
13ea7f
     // If curwin->w_buffer is null, enter_buffer() will make it valid again
13ea7f
-    if ((buf_valid(buf) && buf != curbuf
13ea7f
+    valid = buf_valid(buf);
13ea7f
+    if ((valid && buf != curbuf
13ea7f
 #ifdef FEAT_EVAL
13ea7f
 		&& !aborting()
13ea7f
 #endif
13ea7f
 	) || curwin->w_buffer == NULL)
13ea7f
     {
13ea7f
-	enter_buffer(buf);
13ea7f
+	// If the buffer is not valid but curwin->w_buffer is NULL we must
13ea7f
+	// enter some buffer.  Using the last one is hopefully OK.
13ea7f
+	if (!valid)
13ea7f
+	    enter_buffer(lastbuf);
13ea7f
+	else
13ea7f
+	    enter_buffer(buf);
13ea7f
 #ifdef FEAT_SYN_HL
13ea7f
 	if (old_tw != curbuf->b_p_tw)
13ea7f
 	    check_colorcolumn(curwin);
13ea7f
@@ -2286,8 +2293,7 @@ free_buf_options(
13ea7f
     clear_string_option(&buf->b_p_vsts);
13ea7f
     vim_free(buf->b_p_vsts_nopaste);
13ea7f
     buf->b_p_vsts_nopaste = NULL;
13ea7f
-    vim_free(buf->b_p_vsts_array);
13ea7f
-    buf->b_p_vsts_array = NULL;
13ea7f
+    VIM_CLEAR(buf->b_p_vsts_array);
13ea7f
     clear_string_option(&buf->b_p_vts);
13ea7f
     VIM_CLEAR(buf->b_p_vts_array);
13ea7f
 #endif
13ea7f
diff -up vim82/src/testdir/test_quickfix.vim.cve0443 vim82/src/testdir/test_quickfix.vim
13ea7f
--- vim82/src/testdir/test_quickfix.vim.cve0443	2021-03-22 10:02:42.000000000 +0100
13ea7f
+++ vim82/src/testdir/test_quickfix.vim	2022-02-10 08:34:10.288204457 +0100
13ea7f
@@ -923,6 +923,7 @@ func Test_locationlist_curwin_was_closed
13ea7f
   call assert_fails('lrewind', 'E924:')
13ea7f
 
13ea7f
   augroup! testgroup
13ea7f
+  delfunc R
13ea7f
 endfunc
13ea7f
 
13ea7f
 func Test_locationlist_cross_tab_jump()
13ea7f
@@ -5372,4 +5373,20 @@ func Test_vimgrep_noswapfile()
13ea7f
   set swapfile
13ea7f
 endfunc
13ea7f
 
13ea7f
+" Weird sequence of commands that caused entering a wiped-out buffer
13ea7f
+func Test_lopen_bwipe()
13ea7f
+  func R()
13ea7f
+    silent! tab lopen
13ea7f
+    e x
13ea7f
+    silent! lfile
13ea7f
+  endfunc
13ea7f
+
13ea7f
+  cal R()
13ea7f
+  cal R()
13ea7f
+  cal R()
13ea7f
+  bw!
13ea7f
+  delfunc R
13ea7f
+endfunc
13ea7f
+
13ea7f
+
13ea7f
 " vim: shiftwidth=2 sts=2 expandtab