patch 8.1.2197: ExitPre autocommand may cause accessing freed memory

Problem:    ExitPre autocommand may cause accessing freed memory.
Solution:   Check the window pointer is still valid. (closes #5093)

diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index d9fe7de75e1bddc6537da998719c6d50241e7e62..385cf3b4ae279b7007b01d5e57148547ebecfe47 100644 (file)
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -4817,9 +4817,9 @@ before_quit_autocmds(win_T *wp, int quit_all, int forceit)
 {
     apply_autocmds(EVENT_QUITPRE, NULL, NULL, FALSE, wp->w_buffer);
 
-    /* Bail out when autocommands closed the window.
-     * Refuse to quit when the buffer in the last window is being closed (can
-     * only happen in autocommands). */
+    // Bail out when autocommands closed the window.
+    // Refuse to quit when the buffer in the last window is being closed (can
+    // only happen in autocommands).
     if (!win_valid(wp)
            || curbuf_locked()
            || (wp->w_buffer->b_nwindows == 1 && wp->w_buffer->b_locked > 0))
@@ -4828,9 +4828,10 @@ before_quit_autocmds(win_T *wp, int quit_all, int forceit)
     if (quit_all || (check_more(FALSE, forceit) == OK && only_one_window()))
     {
        apply_autocmds(EVENT_EXITPRE, NULL, NULL, FALSE, curbuf);
-       /* Refuse to quit when locked or when the buffer in the last window is
-        * being closed (can only happen in autocommands). */
-       if (curbuf_locked()
+       // Refuse to quit when locked or when the window was closed or the
+       // buffer in the last window is being closed (can only happen in
+       // autocommands).
+       if (!win_valid(wp) || curbuf_locked()
                          || (curbuf->b_nwindows == 1 && curbuf->b_locked > 0))
            return TRUE;
     }

diff --git a/src/testdir/test_exit.vim b/src/testdir/test_exit.vim
index 3797626abf5551df6639da6282dcb95bec208f93..99a401d4a4298b05e59052f229a5fbc6ee43cefe 100644 (file)
--- a/src/testdir/test_exit.vim
+++ b/src/testdir/test_exit.vim
@@ -40,6 +40,7 @@ func Test_exiting()
   endif
   call delete('Xtestout')
 
+  " ExitPre autocommand splits the window, so that it's no longer the last one.
   let after =<< trim [CODE]
     au QuitPre * call writefile(["QuitPre"], "Xtestout", "a")
     au ExitPre * call writefile(["ExitPre"], "Xtestout", "a")
@@ -58,4 +59,25 @@ func Test_exiting()
          \ readfile('Xtestout'))
   endif
   call delete('Xtestout')
+
+  " ExitPre autocommand splits and closes the window, so that there is still
+  " one window but it's a different one.
+  let after =<< trim [CODE]
+    au QuitPre * call writefile(["QuitPre"], "Xtestout", "a")
+    au ExitPre * call writefile(["ExitPre"], "Xtestout", "a")
+    augroup nasty
+      au ExitPre * split | only
+    augroup END
+    quit
+    augroup nasty
+      au! ExitPre
+    augroup END
+    quit
+  [CODE]
+
+  if RunVim([], after, '')
+    call assert_equal(['QuitPre', 'ExitPre', 'QuitPre', 'ExitPre'],
+         \ readfile('Xtestout'))
+  endif
+  call delete('Xtestout')
 endfunc

diff --git a/src/version.c b/src/version.c
index f2a8d6ca91ae73641f9bf3063365c5f1a0cb179e..549b7eea7e651f06c73925e8b1737a3906929a78 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -741,6 +741,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2197,
 /**/
     2196,
 /**/