# HG changeset patch # User Bram Moolenaar # Date 1585079103 -3600 # Node ID 472dc753e98599b065658f81628dfa9fe020997e # Parent ff2bd976083bb89c81e722b8b5f1829712d5abb7 patch 8.2.0442: channel contents might be used after being freed Commit: https://github.com/vim/vim/commit/71658f74ae64c366b2d35b82c0a2eadb1317f028 Author: Bram Moolenaar Date: Tue Mar 24 20:35:19 2020 +0100 patch 8.2.0442: channel contents might be used after being freed Problem: Channel contents might be used after being freed. Solution: Reset the job channel before freeing the channel. diff --git a/src/channel.c b/src/channel.c --- a/src/channel.c +++ b/src/channel.c @@ -396,6 +396,7 @@ channel_can_close(channel_T *channel) /* * Close a channel and free all its resources. + * The "channel" pointer remains valid. */ static void channel_free_contents(channel_T *channel) @@ -405,6 +406,9 @@ channel_free_contents(channel_T *channel ch_log(channel, "Freeing channel"); } +/* + * Unlink "channel" from the list of channels and free it. + */ static void channel_free_channel(channel_T *channel) { @@ -497,10 +501,8 @@ free_unused_channels(int copyID, int mas ch_next = ch->ch_next; if (!channel_still_useful(ch) && (ch->ch_copyID & mask) != (copyID & mask)) - { // Free the channel struct itself. channel_free_channel(ch); - } } } @@ -4454,15 +4456,12 @@ channel_parse_messages(void) } if (channel->ch_to_be_freed || channel->ch_killing) { - if (channel->ch_killing) - { - channel_free_contents(channel); - channel_free_channel(channel); + channel_free_contents(channel); + if (channel->ch_job != NULL) channel->ch_job->jv_channel = NULL; - } - else - channel_free(channel); - // channel has been freed, start over + + // free the channel and then start over + channel_free_channel(channel); channel = first_channel; continue; } diff --git a/src/version.c b/src/version.c --- a/src/version.c +++ b/src/version.c @@ -739,6 +739,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 442, +/**/ 441, /**/ 440,