7.3.073

   1 To: vim_dev@googlegroups.com
   2 Subject: Patch 7.3.073
   3 Fcc: outbox
   4 From: Bram Moolenaar <Bram@moolenaar.net>
   5 Mime-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8 ------------
   9
  10 Patch 7.3.073
  11 Problem:    Double free memory when netbeans command follows DETACH.
  12 Solution:   Only free the node when owned. (Xavier de Gaye)
  13 Files:      src/netbeans.c
  14
  15
  16 *** ../vim-7.3.072/src/netbeans.c       2010-11-16 15:48:57.000000000 +0100
  17 --- src/netbeans.c      2010-12-02 16:59:11.000000000 +0100
  18 ***************
  19 *** 643,648 ****
  20 --- 643,649 ----
  21   {
  22       char_u    *p;
  23       queue_T   *node;
  24 +     int               own_node;
  25
  26       while (head.next != NULL && head.next != &head)
  27       {
  28 ***************
  29 *** 681,700 ****
  30             *p++ = NUL;
  31             if (*p == NUL)
  32             {
  33                 head.next = node->next;
  34                 node->next->prev = node->prev;
  35             }
  36
  37             /* now, parse and execute the commands */
  38             nb_parse_cmd(node->buffer);
  39
  40 !           if (*p == NUL)
  41             {
  42                 /* buffer finished, dispose of the node and buffer */
  43                 vim_free(node->buffer);
  44                 vim_free(node);
  45             }
  46 !           else
  47             {
  48                 /* more follows, move to the start */
  49                 STRMOVE(node->buffer, p);
  50 --- 682,706 ----
  51             *p++ = NUL;
  52             if (*p == NUL)
  53             {
  54 +               own_node = TRUE;
  55                 head.next = node->next;
  56                 node->next->prev = node->prev;
  57             }
  58 +           else
  59 +               own_node = FALSE;
  60
  61             /* now, parse and execute the commands */
  62             nb_parse_cmd(node->buffer);
  63
  64 !           if (own_node)
  65             {
  66                 /* buffer finished, dispose of the node and buffer */
  67                 vim_free(node->buffer);
  68                 vim_free(node);
  69             }
  70 !           /* Check that "head" wasn't changed under our fingers, e.g. when a
  71 !            * DETACH command was handled. */
  72 !           else if (head.next == node)
  73             {
  74                 /* more follows, move to the start */
  75                 STRMOVE(node->buffer, p);
  76 *** ../vim-7.3.072/src/version.c        2010-12-02 16:01:23.000000000 +0100
  77 --- src/version.c       2010-12-02 17:00:29.000000000 +0100
  78 ***************
  79 *** 716,717 ****
  80 --- 716,719 ----
  81   {   /* Add new patch number below this line */
  82 + /**/
  83 +     73,
  84   /**/
  85
  86 --
  87 If the Universe is constantly expanding, why can't I ever find a parking space?
  88
  89  /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
  90 ///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
  91 \\\  an exciting new programming language -- http://www.Zimbu.org        ///
  92  \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///