# HG changeset patch
# User Bram Moolenaar <bram@vim.org>
# Date 1291306194 -3600
# Node ID ac04f392ba48436bc1b90d3d8b8d384fef4f8135
# Parent  b2a7d143abe2f572e713acda4a67ebce76511bc8
updated for version 7.3.073
Problem:    Double free memory when netbeans command follows DETACH.
Solution:   Only free the node when owned. (Xavier de Gaye)

diff --git a/src/netbeans.c b/src/netbeans.c
--- a/src/netbeans.c
+++ b/src/netbeans.c
@@ -643,6 +643,7 @@ netbeans_parse_messages(void)
 {
     char_u	*p;
     queue_T	*node;
+    int		own_node;
 
     while (head.next != NULL && head.next != &head)
     {
@@ -681,20 +682,25 @@ netbeans_parse_messages(void)
 	    *p++ = NUL;
 	    if (*p == NUL)
 	    {
+		own_node = TRUE;
 		head.next = node->next;
 		node->next->prev = node->prev;
 	    }
+	    else
+		own_node = FALSE;
 
 	    /* now, parse and execute the commands */
 	    nb_parse_cmd(node->buffer);
 
-	    if (*p == NUL)
+	    if (own_node)
 	    {
 		/* buffer finished, dispose of the node and buffer */
 		vim_free(node->buffer);
 		vim_free(node);
 	    }
-	    else
+	    /* Check that "head" wasn't changed under our fingers, e.g. when a
+	     * DETACH command was handled. */
+	    else if (head.next == node)
 	    {
 		/* more follows, move to the start */
 		STRMOVE(node->buffer, p);
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -715,6 +715,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    73,
+/**/
     72,
 /**/
     71,