patch 7.4.1704

Problem:    Using freed memory with "wincmd p". (Dominique Pelle)
Solution:   Also clear "prevwin" in other tab pages.

diff --git a/src/version.c b/src/version.c
index ea6d1c37e2c800edfe0eb0b2df14ff687c5bd900..58377a49effa0bd58e4e5797bd7840a91de8f6e6 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -748,6 +748,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1704,
 /**/
     1703,
 /**/

diff --git a/src/window.c b/src/window.c
index c7905aec57aa825ae1a7145eaa43f0a09eb70fb7..bbd0a527c017017c984ca9ddf98775fb61ebf9c8 100644 (file)
--- a/src/window.c
+++ b/src/window.c
@@ -340,7 +340,7 @@ newwindow:
 /* cursor to last accessed (previous) window */
     case 'p':
     case Ctrl_P:
-               if (prevwin == NULL)
+               if (!win_valid(prevwin))
                    beep_flush();
                else
                    win_goto(prevwin);
@@ -4577,8 +4577,15 @@ win_free(
     unref_var_dict(wp->w_vars);
 #endif
 
-    if (prevwin == wp)
-       prevwin = NULL;
+    {
+       tabpage_T       *ttp;
+
+       if (prevwin == wp)
+           prevwin = NULL;
+       for (ttp = first_tabpage; ttp != NULL; ttp = ttp->tp_next)
+           if (ttp->tp_prevwin == wp)
+               ttp->tp_prevwin = NULL;
+    }
     win_free_lsize(wp);
 
     for (i = 0; i < wp->w_tagstacklen; ++i)