Mercurial > vim

diff src/window.c @ 13144:20fb8c711050 v8.0.1446

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
patch 8.0.1446: acessing freed memory after window command in auto command commit https://github.com/vim/vim/commit/6f361c991221e96d5068c77b854967d997b1529b Author: Bram Moolenaar <Bram@vim.org> Date: Wed Jan 31 19:06:50 2018 +0100 patch 8.0.1446: acessing freed memory after window command in auto command Problem: Acessing freed memory after window command in auto command. (gy741) Solution: Adjust the pointer in the parent frame. (Christian Brabandt, closes #2467)
author Christian Brabandt <cb@256bit.org>
date Wed, 31 Jan 2018 19:15:06 +0100
parents 788d01164bb2
children ac42c4b11dbc
line wrap: on
line diff
--- a/src/window.c
+++ b/src/window.c
@@ -2731,6 +2731,8 @@ winframe_remove(
 	if (frp2->fr_win != NULL)
 	    frp2->fr_win->w_frame = frp2->fr_parent;
 	frp = frp2->fr_parent;
+	if (topframe->fr_child == frp2)
+	    topframe->fr_child = frp;
 	vim_free(frp2);
 
 	frp2 = frp->fr_parent;
@@ -2754,6 +2756,8 @@ winframe_remove(
 		    break;
 		}
 	    }
+	    if (topframe->fr_child == frp)
+		topframe->fr_child = frp2;
 	    vim_free(frp);
 	}
     }
@@ -3499,7 +3503,6 @@ win_alloc_firstwin(win_T *oldwin)
     topframe = curwin->w_frame;
     topframe->fr_width = Columns;
     topframe->fr_height = Rows - p_ch;
-    topframe->fr_win = curwin;
 
     return OK;
 }
@@ -4812,7 +4815,12 @@ frame_remove(frame_T *frp)
     if (frp->fr_prev != NULL)
 	frp->fr_prev->fr_next = frp->fr_next;
     else
+    {
 	frp->fr_parent->fr_child = frp->fr_next;
+	/* special case: topframe->fr_child == frp */
+	if (topframe->fr_child == frp)
+	    topframe->fr_child = frp->fr_next;
+    }
     if (frp->fr_next != NULL)
 	frp->fr_next->fr_prev = frp->fr_prev;
 }