patch 8.0.1413: accessing freed memory in :cbuffer

Problem:    Accessing freed memory in :cbuffer.
Solution:   Get quickfix list after executing autocmds. (closes #2470)

diff --git a/src/quickfix.c b/src/quickfix.c
index 6e80ddfca302a09e55b24ccc9a0f626db443d0e6..87c60858014fefda59fac42d25a9cb1e045c36de 100644 (file)
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -5520,14 +5520,6 @@ ex_cbuffer(exarg_T *eap)
 #endif
     int                res;
 
-    if (eap->cmdidx == CMD_lbuffer || eap->cmdidx == CMD_lgetbuffer
-           || eap->cmdidx == CMD_laddbuffer)
-    {
-       qi = ll_get_or_alloc_list(curwin);
-       if (qi == NULL)
-           return;
-    }
-
 #ifdef FEAT_AUTOCMD
     switch (eap->cmdidx)
     {
@@ -5549,6 +5541,15 @@ ex_cbuffer(exarg_T *eap)
     }
 #endif
 
+    /* Must come after autocommands. */
+    if (eap->cmdidx == CMD_lbuffer || eap->cmdidx == CMD_lgetbuffer
+           || eap->cmdidx == CMD_laddbuffer)
+    {
+       qi = ll_get_or_alloc_list(curwin);
+       if (qi == NULL)
+           return;
+    }
+
     if (*eap->arg == NUL)
        buf = curbuf;
     else if (*skipwhite(skipdigits(eap->arg)) == NUL)

diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
index d8fddffebb7467701cbb54f824bc4e272623edb5..0636c472157089c56e0956e4823b91241ca8c7e2 100644 (file)
--- a/src/testdir/test_autocmd.vim
+++ b/src/testdir/test_autocmd.vim
@@ -1178,3 +1178,10 @@ func Test_nocatch_wipe_dummy_buffer()
   call assert_fails('lv½ /x', 'E480')
   au!
 endfunc
+
+func Test_wipe_cbuffer()
+  sv x
+  au * * bw
+  lb
+  au!
+endfunc

diff --git a/src/version.c b/src/version.c
index 22df4f924d1c41fe36e9e43fd522f14ec42c316e..479116bd6b58ef69f36de5f9f70a6067c6a6a277 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -771,6 +771,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1413,
 /**/
     1412,
 /**/