# HG changeset patch
# User Christian Brabandt <cb@256bit.org>
# Date 1502744404 -7200
# Node ID 4e9c14cb1f5de27bba2219a990f472a1706835e5
# Parent  8988a0c73f5b34b3f43657928d189efb9e5fb64b
patch 8.0.0942: using freed memory with ":terminal"

commit https://github.com/vim/vim/commit/4fa1019f8026cb383423fb4086cba7e308591e18
Author: Bram Moolenaar <Bram@vim.org>
Date:   Mon Aug 14 22:56:27 2017 +0200

    patch 8.0.0942: using freed memory with ":terminal"

    Problem:    Using freed memory with ":terminal" if an autocommand changes
                'shell' when splitting the window. (Marius Gedminas)
    Solution:   Make a copy of 'shell'. (closes #1974)

diff --git a/src/terminal.c b/src/terminal.c
--- a/src/terminal.c
+++ b/src/terminal.c
@@ -392,7 +392,8 @@ term_start(typval_T *argvar, jobopt_T *o
     setup_job_options(opt, term->tl_rows, term->tl_cols);
 
     /* System dependent: setup the vterm and start the job in it. */
-    if (term_and_job_init(term, term->tl_rows, term->tl_cols, argvar, opt) == OK)
+    if (term_and_job_init(term, term->tl_rows, term->tl_cols, argvar, opt)
+									 == OK)
     {
 	/* Get and remember the size we ended up with.  Update the pty. */
 	vterm_get_size(term->tl_vterm, &term->tl_rows, &term->tl_cols);
@@ -434,6 +435,7 @@ ex_terminal(exarg_T *eap)
     typval_T	argvar;
     jobopt_T	opt;
     char_u	*cmd;
+    char_u	*tofree = NULL;
 
     init_job_options(&opt);
 
@@ -462,7 +464,8 @@ ex_terminal(exarg_T *eap)
 	cmd = skipwhite(p);
     }
     if (cmd == NULL || *cmd == NUL)
-	cmd = p_sh;
+	/* Make a copy, an autocommand may set 'shell'. */
+	tofree = cmd = vim_strsave(p_sh);
 
     if (eap->addr_count == 2)
     {
@@ -480,6 +483,7 @@ ex_terminal(exarg_T *eap)
     argvar.v_type = VAR_STRING;
     argvar.vval.v_string = cmd;
     term_start(&argvar, &opt, eap->forceit);
+    vim_free(tofree);
 }
 
 /*
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -770,6 +770,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    942,
+/**/
     941,
 /**/
     940,