diff options
| author | Bram Moolenaar <bram@vim.org> | 2010-12-02 17:09:54 +0100 |
|---|---|---|
| committer | Bram Moolenaar <bram@vim.org> | 2010-12-02 17:09:54 +0100 |
| commit | 8a7b9f40fee2e578e12d39c3d2c10f27b570b3fa (patch) | |
| tree | ea230d2d32c14e588b40f449f550bad93944f1f7 | |
| parent | 57cbac362d45e21ca11a00ec485cd974c3fc2ce4 (diff) | |
| download | vim-8a7b9f40fee2e578e12d39c3d2c10f27b570b3fa.tar.gz | |
Problem: Double free memory when netbeans command follows DETACH.
Solution: Only free the node when owned. (Xavier de Gaye)
| -rw-r--r-- | src/netbeans.c | 10 | ||||
| -rw-r--r-- | src/version.c | 2 |
2 files changed, 10 insertions, 2 deletions
diff --git a/src/netbeans.c b/src/netbeans.c index 7ba8d8dc..3134db9d 100644 --- a/src/netbeans.c +++ b/src/netbeans.c @@ -643,6 +643,7 @@ netbeans_parse_messages(void) { char_u *p; queue_T *node; + int own_node; while (head.next != NULL && head.next != &head) { @@ -681,20 +682,25 @@ netbeans_parse_messages(void) *p++ = NUL; if (*p == NUL) { + own_node = TRUE; head.next = node->next; node->next->prev = node->prev; } + else + own_node = FALSE; /* now, parse and execute the commands */ nb_parse_cmd(node->buffer); - if (*p == NUL) + if (own_node) { /* buffer finished, dispose of the node and buffer */ vim_free(node->buffer); vim_free(node); } - else + /* Check that "head" wasn't changed under our fingers, e.g. when a + * DETACH command was handled. */ + else if (head.next == node) { /* more follows, move to the start */ STRMOVE(node->buffer, p); diff --git a/src/version.c b/src/version.c index 85128805..9d414e80 100644 --- a/src/version.c +++ b/src/version.c @@ -715,6 +715,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 73, +/**/ 72, /**/ 71, |