patch 9.0.0490: using freed memory with cmdwin and BufEnter autocmd

Problem:    Using freed memory with cmdwin and BufEnter autocmd.
Solution:   Make sure pointer to b_p_iminsert is still valid.

diff --git a/src/ex_getln.c b/src/ex_getln.c
index 70436b31f05e7546813ce55c59006ac3ff40ce13..a4fb61145c96f7bd5206ccb053887d23123af932 100644 (file)
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -1587,6 +1587,7 @@ getcmdline_int(
 #endif
     expand_T   xpc;
     long       *b_im_ptr = NULL;
+    buf_T      *b_im_ptr_buf = NULL;   // buffer where b_im_ptr is valid
     cmdline_info_T save_ccline;
     int                did_save_ccline = FALSE;
     int                cmdline_type;
@@ -1683,6 +1684,7 @@ getcmdline_int(
            b_im_ptr = &curbuf->b_p_iminsert;
        else
            b_im_ptr = &curbuf->b_p_imsearch;
+       b_im_ptr_buf = curbuf;
        if (*b_im_ptr == B_IMODE_LMAP)
            State |= MODE_LANGMAP;
 #ifdef HAVE_INPUT_METHOD
@@ -2034,7 +2036,8 @@ getcmdline_int(
                goto cmdline_not_changed;
 
        case Ctrl_HAT:
-               cmdline_toggle_langmap(b_im_ptr);
+               cmdline_toggle_langmap(
+                                   buf_valid(b_im_ptr_buf) ? b_im_ptr : NULL);
                goto cmdline_not_changed;
 
 //     case '@':   only in very old vi
@@ -2544,7 +2547,8 @@ returncmd:
 #endif
 
 #ifdef HAVE_INPUT_METHOD
-    if (b_im_ptr != NULL && *b_im_ptr != B_IMODE_LMAP)
+    if (b_im_ptr != NULL && buf_valid(b_im_ptr_buf)
+                                                 && *b_im_ptr != B_IMODE_LMAP)
        im_save_status(b_im_ptr);
     im_set_active(FALSE);
 #endif

diff --git a/src/testdir/test_cmdwin.vim b/src/testdir/test_cmdwin.vim
index d62673aba254dda0a2a7703713dc489968422ce3..fe849bcc16863de07b1481e65280be259569622e 100644 (file)
--- a/src/testdir/test_cmdwin.vim
+++ b/src/testdir/test_cmdwin.vim
@@ -378,5 +378,15 @@ func Test_normal_escape()
   call assert_equal('" bar', @:)
 endfunc
 
+" This was using a pointer to a freed buffer
+func Test_cmdwin_freed_buffer_ptr()
+  au BufEnter * next 0| file \v
+  edit 0
+  silent! norm q/
+
+  au! BufEnter
+  bwipe!
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index f4c5fb4a893801cf7a488a9fabc25e67e257742c..7d7ac1654e776c1b05711cdbcb5b545d84d3fb8a 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -703,6 +703,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    490,
 /**/
     489,
 /**/