diff options
| author | Bram Moolenaar <Bram@vim.org> | 2019-07-07 20:43:34 +0200 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2019-07-07 20:43:34 +0200 |
| commit | 3e35d05b1f99419be27ea5be70c7d0610202c163 (patch) | |
| tree | e3a3f347bce15ae2da882e94d2f6998861298efc | |
| parent | 3f3e954d9676e374f222a18786c78e50af5041cb (diff) | |
| download | vim-git-3e35d05b1f99419be27ea5be70c7d0610202c163.tar.gz | |
patch 8.1.1649: Illegal memory access when closing popup windowv8.1.1649
Problem: Illegal memory access when closing popup window.
Solution: Get w_next before closing the window.
| -rw-r--r-- | src/popupwin.c | 13 | ||||
| -rw-r--r-- | src/version.c | 2 |
2 files changed, 12 insertions, 3 deletions
diff --git a/src/popupwin.c b/src/popupwin.c index 401f1fbea..32f486181 100644 --- a/src/popupwin.c +++ b/src/popupwin.c @@ -1437,6 +1437,7 @@ check_mouse_moved(win_T *wp, win_T *mouse_wp) res.v_type = VAR_NUMBER; res.vval.v_number = -2; + // Careful: this makes "wp" invalid. popup_close_and_callback(wp, &res); } } @@ -1447,7 +1448,7 @@ check_mouse_moved(win_T *wp, win_T *mouse_wp) void popup_handle_mouse_moved(void) { - win_T *wp; + win_T *wp, *nextwp; win_T *mouse_wp; int row = mouse_row; int col = mouse_col; @@ -1455,10 +1456,16 @@ popup_handle_mouse_moved(void) // find the window where the mouse is in mouse_wp = mouse_find_win(&row, &col, FIND_POPUP); - for (wp = first_popupwin; wp != NULL; wp = wp->w_next) + for (wp = first_popupwin; wp != NULL; wp = nextwp) + { + nextwp = wp->w_next; check_mouse_moved(wp, mouse_wp); - for (wp = curtab->tp_first_popupwin; wp != NULL; wp = wp->w_next) + } + for (wp = curtab->tp_first_popupwin; wp != NULL; wp = nextwp) + { + nextwp = wp->w_next; check_mouse_moved(wp, mouse_wp); + } } /* diff --git a/src/version.c b/src/version.c index 4952b7088..82f90932c 100644 --- a/src/version.c +++ b/src/version.c @@ -778,6 +778,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 1649, +/**/ 1648, /**/ 1647, |