diff options
| author | Bram Moolenaar <Bram@vim.org> | 2010-12-02 17:09:54 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2010-12-02 17:09:54 +0100 |
| commit | 863053d1d4b1508c6e4285f01c2d743d7a211ea4 (patch) | |
| tree | 76addde7a440fbd98f6bf5b4fde44db44c7ecfc4 | |
| parent | 94950a9ee02369c9bb26d81be7c20ced166943ec (diff) | |
| download | vim-git-7.3.073.tar.gz | |
updated for version 7.3.073v7.3.073
Problem: Double free memory when netbeans command follows DETACH.
Solution: Only free the node when owned. (Xavier de Gaye)
| -rw-r--r-- | src/netbeans.c | 10 | ||||
| -rw-r--r-- | src/version.c | 2 |
2 files changed, 10 insertions, 2 deletions
diff --git a/src/netbeans.c b/src/netbeans.c index 7ba8d8dc2..3134db9d2 100644 --- a/src/netbeans.c +++ b/src/netbeans.c @@ -643,6 +643,7 @@ netbeans_parse_messages(void) { char_u *p; queue_T *node; + int own_node; while (head.next != NULL && head.next != &head) { @@ -681,20 +682,25 @@ netbeans_parse_messages(void) *p++ = NUL; if (*p == NUL) { + own_node = TRUE; head.next = node->next; node->next->prev = node->prev; } + else + own_node = FALSE; /* now, parse and execute the commands */ nb_parse_cmd(node->buffer); - if (*p == NUL) + if (own_node) { /* buffer finished, dispose of the node and buffer */ vim_free(node->buffer); vim_free(node); } - else + /* Check that "head" wasn't changed under our fingers, e.g. when a + * DETACH command was handled. */ + else if (head.next == node) { /* more follows, move to the start */ STRMOVE(node->buffer, p); diff --git a/src/version.c b/src/version.c index 85128805f..9d414e803 100644 --- a/src/version.c +++ b/src/version.c @@ -715,6 +715,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 73, +/**/ 72, /**/ 71, |