From 3320b998165e82c5c2fa50ac82e8ae577215ab24 Mon Sep 17 00:00:00 2001
From: "Justin M. Keyes" <justinkz@gmail.com>
Date: Sun, 15 May 2016 16:40:37 -0400
Subject: [PATCH 1/2] test: ex_terminal() double-free

References #4554
---
 test/functional/terminal/ex_terminal_spec.lua | 19 ++++++++-----------
 1 file changed, 8 insertions(+), 11 deletions(-)

diff --git a/test/functional/terminal/ex_terminal_spec.lua b/test/functional/terminal/ex_terminal_spec.lua
index 493539b4d3..7f9736e5b0 100644
--- a/test/functional/terminal/ex_terminal_spec.lua
+++ b/test/functional/terminal/ex_terminal_spec.lua
@@ -1,7 +1,7 @@
 local helpers = require('test.functional.helpers')
 local Screen = require('test.functional.ui.screen')
 local clear, wait, nvim = helpers.clear, helpers.wait, helpers.nvim
-local nvim_dir = helpers.nvim_dir
+local nvim_dir, source = helpers.nvim_dir, helpers.source
 local execute = helpers.execute
 
 describe(':terminal', function()
@@ -9,7 +9,7 @@ describe(':terminal', function()
 
   before_each(function()
     clear()
-    screen = Screen.new(50, 7)
+    screen = Screen.new(50, 4)
     screen:attach(false)
     nvim('set_option', 'shell', nvim_dir..'/shell-test')
     nvim('set_option', 'shellcmdflag', 'EXE')
@@ -23,9 +23,6 @@ describe(':terminal', function()
       ready $                                           |
       [Process exited 0]                                |
                                                         |
-                                                        |
-                                                        |
-                                                        |
       -- TERMINAL --                                    |
     ]])
   end)
@@ -37,9 +34,6 @@ describe(':terminal', function()
       ready $ echo hi                                   |
                                                         |
       [Process exited 0]                                |
-                                                        |
-                                                        |
-                                                        |
       -- TERMINAL --                                    |
     ]])
   end)
@@ -51,10 +45,13 @@ describe(':terminal', function()
       ready $ echo 'hello' \ "world"                    |
                                                         |
       [Process exited 0]                                |
-                                                        |
-                                                        |
-                                                        |
       -- TERMINAL --                                    |
     ]])
   end)
+
+  it('ex_terminal() double-free #4554', function()
+    source([[
+      autocmd BufNew * set shell=foo
+      terminal]])
+  end)
 end)

From 36fb600a9e98b1f41f53783977bbd7b96c254a1b Mon Sep 17 00:00:00 2001
From: "Justin M. Keyes" <justinkz@gmail.com>
Date: Sun, 15 May 2016 16:56:29 -0400
Subject: [PATCH 2/2] ex_terminal(): fix double-free

Closes #4554
---
 src/nvim/ex_docmd.c                           | 8 +++++---
 test/functional/terminal/ex_terminal_spec.lua | 6 ++++--
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/src/nvim/ex_docmd.c b/src/nvim/ex_docmd.c
index 89c35a3c45..9a68a7c2a5 100644
--- a/src/nvim/ex_docmd.c
+++ b/src/nvim/ex_docmd.c
@@ -9497,12 +9497,14 @@ static void ex_folddo(exarg_T *eap)
 
 static void ex_terminal(exarg_T *eap)
 {
-  // We will call termopen() with ['shell'] if not given a {cmd}.
-  char *name = (char *)p_sh;
+  char *name = (char *)p_sh;  // Default to 'shell' if {cmd} is not given.
+  bool mustfree = false;
   char *lquote = "['";
   char *rquote = "']";
+
   if (*eap->arg != NUL) {
     name = (char *)vim_strsave_escaped(eap->arg, (char_u *)"\"\\");
+    mustfree = true;
     lquote = rquote = "\"";
   }
 
@@ -9512,7 +9514,7 @@ static void ex_terminal(exarg_T *eap)
            eap->forceit==TRUE ? "!" : "", lquote, name, rquote);
   do_cmdline_cmd(ex_cmd);
 
-  if (name != (char *)p_sh) {
+  if (mustfree) {
     xfree(name);
   }
 }
diff --git a/test/functional/terminal/ex_terminal_spec.lua b/test/functional/terminal/ex_terminal_spec.lua
index 7f9736e5b0..a3937ca4ba 100644
--- a/test/functional/terminal/ex_terminal_spec.lua
+++ b/test/functional/terminal/ex_terminal_spec.lua
@@ -1,8 +1,8 @@
 local helpers = require('test.functional.helpers')
 local Screen = require('test.functional.ui.screen')
 local clear, wait, nvim = helpers.clear, helpers.wait, helpers.nvim
-local nvim_dir, source = helpers.nvim_dir, helpers.source
-local execute = helpers.execute
+local nvim_dir, source, ok = helpers.nvim_dir, helpers.source, helpers.ok
+local execute, eval = helpers.execute, helpers.eval
 
 describe(':terminal', function()
   local screen
@@ -53,5 +53,7 @@ describe(':terminal', function()
     source([[
       autocmd BufNew * set shell=foo
       terminal]])
+      -- Verify that BufNew actually fired (else the test is useless).
+    ok('foo' == eval('&shell'))
   end)
 end)