updated for version 7.3.073

Problem:    Double free memory when netbeans command follows DETACH.
Solution:   Only free the node when owned. (Xavier de Gaye)

diff --git a/src/netbeans.c b/src/netbeans.c
index 7ba8d8dc214d6b2b08a1892bfc72f10661287bd1..3134db9d238262bc2bba9f0feba5b08c8ce158b1 100644 (file)
--- a/src/netbeans.c
+++ b/src/netbeans.c
@@ -643,6 +643,7 @@ netbeans_parse_messages(void)
 {
     char_u     *p;
     queue_T    *node;
+    int                own_node;
 
     while (head.next != NULL && head.next != &head)
     {
@@ -681,20 +682,25 @@ netbeans_parse_messages(void)
            *p++ = NUL;
            if (*p == NUL)
            {
+               own_node = TRUE;
                head.next = node->next;
                node->next->prev = node->prev;
            }
+           else
+               own_node = FALSE;
 
            /* now, parse and execute the commands */
            nb_parse_cmd(node->buffer);
 
-           if (*p == NUL)
+           if (own_node)
            {
                /* buffer finished, dispose of the node and buffer */
                vim_free(node->buffer);
                vim_free(node);
            }
-           else
+           /* Check that "head" wasn't changed under our fingers, e.g. when a
+            * DETACH command was handled. */
+           else if (head.next == node)
            {
                /* more follows, move to the start */
                STRMOVE(node->buffer, p);

diff --git a/src/version.c b/src/version.c
index 85128805fd5490a00b1d14b5f69aa3f8a6b07869..9d414e80301bdbbb1a878e7ad9b5c761a2d3428f 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -714,6 +714,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    73,
 /**/
     72,
 /**/