patch 8.2.3476: renaming a buffer on startup may cause using freed memory

Problem:    Renaming a buffer on startup may cause using freed memory.
Solution:   Check if the buffer is used in a window. (closes #8955)

diff --git a/src/buffer.c b/src/buffer.c
index 5616487da913bb192f8ba071177ae627c98964c1..bcbdf839dd8ba5cca9050e9801dc088fa7811a53 100644 (file)
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -3399,7 +3399,17 @@ setfname(
 #endif
        if (obuf != NULL && obuf != buf)
        {
-           if (obuf->b_ml.ml_mfp != NULL)      // it's loaded, fail
+           win_T       *win;
+           tabpage_T   *tab;
+           int         in_use = FALSE;
+
+           // during startup a window may use a buffer that is not loaded yet
+           FOR_ALL_TAB_WINDOWS(tab, win)
+               if (win->w_buffer == obuf)
+                   in_use = TRUE;
+
+           // it's loaded or used in a window, fail
+           if (obuf->b_ml.ml_mfp != NULL || in_use)
            {
                if (message)
                    emsg(_("E95: Buffer with this name already exists"));

diff --git a/src/testdir/test_startup.vim b/src/testdir/test_startup.vim
index 6b64adf74800ec83707b186c9655d3406698ee4e..897492deb9cdbc4390b065b4c51d7100ddd9ce98 100644 (file)
--- a/src/testdir/test_startup.vim
+++ b/src/testdir/test_startup.vim
@@ -1296,4 +1296,18 @@ func Test_echo_true_in_cmd()
   call delete('Xresult')
 endfunc
 
+func Test_rename_buffer_on_startup()
+  let lines =<< trim END
+      call writefile(['done'], 'Xresult')
+      qa!
+  END
+  call writefile(lines, 'Xscript')
+  if RunVim([], [], "--clean -e -s --cmd 'file x|new|file x' --cmd 'so Xscript'")
+    call assert_equal(['done'], readfile('Xresult'))
+  endif
+  call delete('Xscript')
+  call delete('Xresult')
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index e6a4b1ad5d8426a30315be1c798b0373b80843f1..95200c666068c5d91f7d1696dc88311042ad51b9 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -757,6 +757,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    3476,
 /**/
     3475,
 /**/