f942a47
To: vim_dev@googlegroups.com
f942a47
Subject: Patch 7.3.073
f942a47
Fcc: outbox
f942a47
From: Bram Moolenaar <Bram@moolenaar.net>
f942a47
Mime-Version: 1.0
f942a47
Content-Type: text/plain; charset=UTF-8
f942a47
Content-Transfer-Encoding: 8bit
f942a47
------------
f942a47
f942a47
Patch 7.3.073
f942a47
Problem:    Double free memory when netbeans command follows DETACH.
f942a47
Solution:   Only free the node when owned. (Xavier de Gaye)
f942a47
Files:	    src/netbeans.c
f942a47
f942a47
f942a47
*** ../vim-7.3.072/src/netbeans.c	2010-11-16 15:48:57.000000000 +0100
f942a47
--- src/netbeans.c	2010-12-02 16:59:11.000000000 +0100
f942a47
***************
f942a47
*** 643,648 ****
f942a47
--- 643,649 ----
f942a47
  {
f942a47
      char_u	*p;
f942a47
      queue_T	*node;
f942a47
+     int		own_node;
f942a47
  
f942a47
      while (head.next != NULL && head.next != &head)
f942a47
      {
f942a47
***************
f942a47
*** 681,700 ****
f942a47
  	    *p++ = NUL;
f942a47
  	    if (*p == NUL)
f942a47
  	    {
f942a47
  		head.next = node->next;
f942a47
  		node->next->prev = node->prev;
f942a47
  	    }
f942a47
  
f942a47
  	    /* now, parse and execute the commands */
f942a47
  	    nb_parse_cmd(node->buffer);
f942a47
  
f942a47
! 	    if (*p == NUL)
f942a47
  	    {
f942a47
  		/* buffer finished, dispose of the node and buffer */
f942a47
  		vim_free(node->buffer);
f942a47
  		vim_free(node);
f942a47
  	    }
f942a47
! 	    else
f942a47
  	    {
f942a47
  		/* more follows, move to the start */
f942a47
  		STRMOVE(node->buffer, p);
f942a47
--- 682,706 ----
f942a47
  	    *p++ = NUL;
f942a47
  	    if (*p == NUL)
f942a47
  	    {
f942a47
+ 		own_node = TRUE;
f942a47
  		head.next = node->next;
f942a47
  		node->next->prev = node->prev;
f942a47
  	    }
f942a47
+ 	    else
f942a47
+ 		own_node = FALSE;
f942a47
  
f942a47
  	    /* now, parse and execute the commands */
f942a47
  	    nb_parse_cmd(node->buffer);
f942a47
  
f942a47
! 	    if (own_node)
f942a47
  	    {
f942a47
  		/* buffer finished, dispose of the node and buffer */
f942a47
  		vim_free(node->buffer);
f942a47
  		vim_free(node);
f942a47
  	    }
f942a47
! 	    /* Check that "head" wasn't changed under our fingers, e.g. when a
f942a47
! 	     * DETACH command was handled. */
f942a47
! 	    else if (head.next == node)
f942a47
  	    {
f942a47
  		/* more follows, move to the start */
f942a47
  		STRMOVE(node->buffer, p);
f942a47
*** ../vim-7.3.072/src/version.c	2010-12-02 16:01:23.000000000 +0100
f942a47
--- src/version.c	2010-12-02 17:00:29.000000000 +0100
f942a47
***************
f942a47
*** 716,717 ****
f942a47
--- 716,719 ----
f942a47
  {   /* Add new patch number below this line */
f942a47
+ /**/
f942a47
+     73,
f942a47
  /**/
f942a47
f942a47
-- 
f942a47
If the Universe is constantly expanding, why can't I ever find a parking space?
f942a47
f942a47
 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
f942a47
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
f942a47
\\\  an exciting new programming language -- http://www.Zimbu.org        ///
f942a47
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///