patch 8.2.0381: using freed memory with :lvimgrep and autocommandv8.2.0381

Problem:    Using freed memory with :lvimgrep and autocommand. (extracted from
            POC by Dominique Pelle)
Solution:   Avoid deleting a dummy buffer used in a window. (closes #5777)

1 files changed, 20 insertions, 1 deletions

diff --git a/src/quickfix.c b/src/quickfix.c
index 7ae489b5d..f82a18716 100644
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -6268,7 +6268,26 @@ load_dummy_buffer(
     static void
 wipe_dummy_buffer(buf_T *buf, char_u *dirname_start)
 {
-    if (curbuf != buf)		// safety check
+    // If any autocommand opened a window on the dummy buffer, close that
+    // window.  If we can't close them all then give up.
+    while (buf->b_nwindows > 0)
+    {
+	int	    did_one = FALSE;
+	win_T	    *wp;
+
+	if (firstwin->w_next != NULL)
+	    for (wp = firstwin; wp != NULL; wp = wp->w_next)
+		if (wp->w_buffer == buf)
+		{
+		    if (win_close(wp, FALSE) == OK)
+			did_one = TRUE;
+		    break;
+		}
+	if (!did_one)
+	    return;
+    }
+
+    if (curbuf != buf && buf->b_nwindows == 0)	// safety check
     {
 #if defined(FEAT_EVAL)
 	cleanup_T   cs;