patch 8.2.3476: renaming a buffer on startup may cause using freed memory

Problem:    Renaming a buffer on startup may cause using freed memory.
Solution:   Check if the buffer is used in a window. (closes #8955)

src/buffer.c

@@ -3399,7 +3399,17 @@ setfname(
 #endif
 	if (obuf != NULL && obuf != buf)
 	{
-	    if (obuf->b_ml.ml_mfp != NULL)	// it's loaded, fail
+	    win_T	*win;
+	    tabpage_T   *tab;
+	    int		in_use = FALSE;
+
+	    // during startup a window may use a buffer that is not loaded yet
+	    FOR_ALL_TAB_WINDOWS(tab, win)
+		if (win->w_buffer == obuf)
+		    in_use = TRUE;
+
+	    // it's loaded or used in a window, fail
+	    if (obuf->b_ml.ml_mfp != NULL || in_use)
 	    {
 		if (message)
 		    emsg(_("E95: Buffer with this name already exists"));

src/testdir/test_startup.vim

@@ -1296,4 +1296,18 @@ func Test_echo_true_in_cmd()
   call delete('Xresult')
 endfunc
 
+func Test_rename_buffer_on_startup()
+  let lines =<< trim END
+      call writefile(['done'], 'Xresult')
+      qa!
+  END
+  call writefile(lines, 'Xscript')
+  if RunVim([], [], "--clean -e -s --cmd 'file x|new|file x' --cmd 'so Xscript'")
+    call assert_equal(['done'], readfile('Xresult'))
+  endif
+  call delete('Xscript')
+  call delete('Xresult')
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab

src/version.c

@@ -757,6 +757,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    3476,
 /**/
     3475,
 /**/