aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-07-26 11:04:33 -04:00
Code

patch 8.0.1446: acessing freed memory after window command in auto command

Browse Source 
Problem:    Acessing freed memory after window command in auto command.
            (gy741)
Solution:   Adjust the pointer in the parent frame. (Christian Brabandt,
            closes #2467)
This commit is contained in:
Bram Moolenaar 2018-01-31 19:06:50 +01:00
parent 153b704e20
commit 6f361c9912
3 changed files with 22 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/testdir/test_window_cmd.vim
View File

@ -472,4 +472,15 @@ func Test_window_colon_command()
exe "norm! v\<C-W>:\<C-U>echo v:version" exe "norm! v\<C-W>:\<C-U>echo v:version"
endfunc endfunc
func Test_access_freed_mem()
" This was accessing freed memory
au * 0 vs xxx
arg 0
argadd
all
all
au!
bwipe xxx
endfunc
" vim: shiftwidth=2 sts=2 expandtab " vim: shiftwidth=2 sts=2 expandtab

2
src/version.c
View File

@ -771,6 +771,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
1446,
/**/ /**/
1445, 1445,
/**/ /**/

10
src/window.c
View File

@ -2731,6 +2731,8 @@ winframe_remove(
if (frp2->fr_win != NULL) if (frp2->fr_win != NULL)
frp2->fr_win->w_frame = frp2->fr_parent; frp2->fr_win->w_frame = frp2->fr_parent;
frp = frp2->fr_parent; frp = frp2->fr_parent;
if (topframe->fr_child == frp2)
topframe->fr_child = frp;
vim_free(frp2); vim_free(frp2);
frp2 = frp->fr_parent; frp2 = frp->fr_parent;
@ -2754,6 +2756,8 @@ winframe_remove(
break; break;
} }
} }
if (topframe->fr_child == frp)
topframe->fr_child = frp2;
vim_free(frp); vim_free(frp);
} }
} }
@ -3499,7 +3503,6 @@ win_alloc_firstwin(win_T *oldwin)
topframe = curwin->w_frame; topframe = curwin->w_frame;
topframe->fr_width = Columns; topframe->fr_width = Columns;
topframe->fr_height = Rows - p_ch; topframe->fr_height = Rows - p_ch;
topframe->fr_win = curwin;
return OK; return OK;
} }
@ -4812,7 +4815,12 @@ frame_remove(frame_T *frp)
if (frp->fr_prev != NULL) if (frp->fr_prev != NULL)
frp->fr_prev->fr_next = frp->fr_next; frp->fr_prev->fr_next = frp->fr_next;
else else
{
frp->fr_parent->fr_child = frp->fr_next; frp->fr_parent->fr_child = frp->fr_next;
/* special case: topframe->fr_child == frp */
if (topframe->fr_child == frp)
topframe->fr_child = frp->fr_next;
}
if (frp->fr_next != NULL) if (frp->fr_next != NULL)
frp->fr_next->fr_prev = frp->fr_prev; frp->fr_next->fr_prev = frp->fr_prev;
} }