patch 8.2.0442: channel contents might be used after being freed

Problem:    Channel contents might be used after being freed.
Solution:   Reset the job channel before freeing the channel.

diff --git a/src/channel.c b/src/channel.c
index 6dde107bfac796985586af6b7296026709187733..a57ed9ccf1a1073d331132b73ec3ef5e70e2f9fa 100644 (file)
--- a/src/channel.c
+++ b/src/channel.c
@@ -396,6 +396,7 @@ channel_can_close(channel_T *channel)
 
 /*
  * Close a channel and free all its resources.
+ * The "channel" pointer remains valid.
  */
     static void
 channel_free_contents(channel_T *channel)
@@ -405,6 +406,9 @@ channel_free_contents(channel_T *channel)
     ch_log(channel, "Freeing channel");
 }
 
+/*
+ * Unlink "channel" from the list of channels and free it.
+ */
     static void
 channel_free_channel(channel_T *channel)
 {
@@ -497,10 +501,8 @@ free_unused_channels(int copyID, int mask)
        ch_next = ch->ch_next;
        if (!channel_still_useful(ch)
                                 && (ch->ch_copyID & mask) != (copyID & mask))
-       {
            // Free the channel struct itself.
            channel_free_channel(ch);
-       }
     }
 }
 
@@ -4454,15 +4456,12 @@ channel_parse_messages(void)
        }
        if (channel->ch_to_be_freed || channel->ch_killing)
        {
-           if (channel->ch_killing)
-           {
-               channel_free_contents(channel);
-               channel_free_channel(channel);
+           channel_free_contents(channel);
+           if (channel->ch_job != NULL)
                channel->ch_job->jv_channel = NULL;
-           }
-           else
-               channel_free(channel);
-           // channel has been freed, start over
+
+           // free the channel and then start over
+           channel_free_channel(channel);
            channel = first_channel;
            continue;
        }

diff --git a/src/version.c b/src/version.c
index 0cf6011632fbf9afd3a0a81c77e05057fa6d4cab..31c5610b92253423737a8187973e5eefcbc7a346 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -738,6 +738,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    442,
 /**/
     441,
 /**/