# HG changeset patch
# User Bram Moolenaar <Bram@vim.org>
# Date 1633385704 -7200
# Node ID 7c640ad754fb46ee15a469264173111f1530a0cf
# Parent  25fbd356bb099554000453d309eb5329538cce27
patch 8.2.3476: renaming a buffer on startup may cause using freed memory

Commit: https://github.com/vim/vim/commit/d3710cf01ef6ab1b2f233866ff01dab76686f642
Author: Bram Moolenaar <Bram@vim.org>
Date:   Mon Oct 4 23:13:13 2021 +0100

    patch 8.2.3476: renaming a buffer on startup may cause using freed memory

    Problem:    Renaming a buffer on startup may cause using freed memory.
    Solution:   Check if the buffer is used in a window. (closes https://github.com/vim/vim/issues/8955)

diff --git a/src/buffer.c b/src/buffer.c
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -3399,7 +3399,17 @@ setfname(
 #endif
 	if (obuf != NULL && obuf != buf)
 	{
-	    if (obuf->b_ml.ml_mfp != NULL)	// it's loaded, fail
+	    win_T	*win;
+	    tabpage_T   *tab;
+	    int		in_use = FALSE;
+
+	    // during startup a window may use a buffer that is not loaded yet
+	    FOR_ALL_TAB_WINDOWS(tab, win)
+		if (win->w_buffer == obuf)
+		    in_use = TRUE;
+
+	    // it's loaded or used in a window, fail
+	    if (obuf->b_ml.ml_mfp != NULL || in_use)
 	    {
 		if (message)
 		    emsg(_("E95: Buffer with this name already exists"));
diff --git a/src/testdir/test_startup.vim b/src/testdir/test_startup.vim
--- a/src/testdir/test_startup.vim
+++ b/src/testdir/test_startup.vim
@@ -1296,4 +1296,18 @@ func Test_echo_true_in_cmd()
   call delete('Xresult')
 endfunc
 
+func Test_rename_buffer_on_startup()
+  let lines =<< trim END
+      call writefile(['done'], 'Xresult')
+      qa!
+  END
+  call writefile(lines, 'Xscript')
+  if RunVim([], [], "--clean -e -s --cmd 'file x|new|file x' --cmd 'so Xscript'")
+    call assert_equal(['done'], readfile('Xresult'))
+  endif
+  call delete('Xscript')
+  call delete('Xresult')
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -758,6 +758,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    3476,
+/**/
     3475,
 /**/
     3474,