mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-09-06 11:28:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.0.1446: acessing freed memory after window command in auto command

Browse Source 
Problem:    Acessing freed memory after window command in auto command.
            (gy741)
Solution:   Adjust the pointer in the parent frame. (Christian Brabandt,
            closes vim/vim#2467)
6f361c9912
This commit is contained in:
Jan Edmund Lazo
2018-07-15 08:36:46 -04:00
parent ce5d755048
commit a8ff55d50e
2 changed files with 26 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/nvim/testdir/test_window_cmd.vim
View File

@@ -455,4 +455,15 @@ func Test_window_contents()
call test_garbagecollect_now() call test_garbagecollect_now()
endfunc endfunc
func Test_access_freed_mem()
" This was accessing freed memory
au * 0 vs xxx
arg 0
argadd
all
all
au!
bwipe xxx
endfunc
" vim: shiftwidth=2 sts=2 expandtab " vim: shiftwidth=2 sts=2 expandtab

19
src/nvim/window.c
View File

@@ -2296,6 +2296,9 @@ winframe_remove (
if (frp2->fr_win != NULL) if (frp2->fr_win != NULL)
frp2->fr_win->w_frame = frp2->fr_parent; frp2->fr_win->w_frame = frp2->fr_parent;
frp = frp2->fr_parent; frp = frp2->fr_parent;
if (topframe->fr_child == frp2) {
topframe->fr_child = frp;
}
xfree(frp2); xfree(frp2);
frp2 = frp->fr_parent; frp2 = frp->fr_parent;
@@ -2317,6 +2320,9 @@ winframe_remove (
break; break;
} }
} }
if (topframe->fr_child == frp) {
topframe->fr_child = frp2;
}
xfree(frp); xfree(frp);
} }
} }
@@ -2959,7 +2965,6 @@ static int win_alloc_firstwin(win_T *oldwin)
topframe = curwin->w_frame; topframe = curwin->w_frame;
topframe->fr_width = Columns; topframe->fr_width = Columns;
topframe->fr_height = Rows - p_ch; topframe->fr_height = Rows - p_ch;
topframe->fr_win = curwin;
return OK; return OK;
} }
@@ -4017,12 +4022,18 @@ static void frame_insert(frame_T *before, frame_T *frp)
*/ */
static void frame_remove(frame_T *frp) static void frame_remove(frame_T *frp)
{ {
if (frp->fr_prev != NULL) if (frp->fr_prev != NULL) {
frp->fr_prev->fr_next = frp->fr_next; frp->fr_prev->fr_next = frp->fr_next;
else } else {
frp->fr_parent->fr_child = frp->fr_next; frp->fr_parent->fr_child = frp->fr_next;
if (frp->fr_next != NULL) // special case: topframe->fr_child == frp
if (topframe->fr_child == frp) {
topframe->fr_child = frp->fr_next;
}
}
if (frp->fr_next != NULL) {
frp->fr_next->fr_prev = frp->fr_prev; frp->fr_next->fr_prev = frp->fr_prev;
}
} }