updated for version 7.3.390

Problem:    Using NULL buffer pointer in a window.
Solution:   Check for w_buffer being NULL in more places. (Bjorn Winckler)

diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index e81b4a2be4e1ee0f7a52359d7dc962ea4e59eb37..519655bebc9cfae45e91b209f63d9aba696c337b 100644 (file)
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -3390,6 +3390,13 @@ do_ecmd(fnum, ffname, sfname, eap, newlnum, flags, oldwin)
                                      (flags & ECMD_HIDE) ? 0 : DOBUF_UNLOAD);
 
 #ifdef FEAT_AUTOCMD
+               /* Autocommands may open a new window and leave oldwin open
+                * which leads to crashes since the above call sets
+                * oldwin->w_buffer to NULL. */
+               if (curwin != oldwin && oldwin != aucmd_win
+                            && win_valid(oldwin) && oldwin->w_buffer == NULL)
+                   win_close(oldwin, FALSE);
+
 # ifdef FEAT_EVAL
                if (aborting())     /* autocmds may abort script processing */
                {

diff --git a/src/quickfix.c b/src/quickfix.c
index 0502392c923437f9b79adf37e4aa1e331bdd1f2e..a2935bea97460646c4cc62c3d43637ce8a1dc295 100644 (file)
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -2675,7 +2675,7 @@ qf_fill_buffer(qi)
 bt_quickfix(buf)
     buf_T      *buf;
 {
-    return (buf->b_p_bt[0] == 'q');
+    return buf != NULL && buf->b_p_bt[0] == 'q';
 }
 
 /*
@@ -2686,8 +2686,8 @@ bt_quickfix(buf)
 bt_nofile(buf)
     buf_T      *buf;
 {
-    return (buf->b_p_bt[0] == 'n' && buf->b_p_bt[2] == 'f')
-           || buf->b_p_bt[0] == 'a';
+    return buf != NULL && ((buf->b_p_bt[0] == 'n' && buf->b_p_bt[2] == 'f')
+           || buf->b_p_bt[0] == 'a');
 }
 
 /*
@@ -2697,7 +2697,7 @@ bt_nofile(buf)
 bt_dontwrite(buf)
     buf_T      *buf;
 {
-    return (buf->b_p_bt[0] == 'n');
+    return buf != NULL && buf->b_p_bt[0] == 'n';
 }
 
     int

diff --git a/src/version.c b/src/version.c
index 5aaf8948e78558e2751d9bd8c8bac41ca271ff28..1deb08f3446cbf0140b5b38af45056d1cb079c34 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -714,6 +714,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    390,
 /**/
     389,
 /**/

diff --git a/src/window.c b/src/window.c
index 6b803f59605c096cfd92d1aee273a487d3bccad6..80c69a1e72fa834e402c32d66a60a32da88bbc5f 100644 (file)
--- a/src/window.c
+++ b/src/window.c
@@ -2170,7 +2170,7 @@ win_close(win, free_buf)
 
     /* When closing the help window, try restoring a snapshot after closing
      * the window.  Otherwise clear the snapshot, it's now invalid. */
-    if (win->w_buffer->b_help)
+    if (win->w_buffer != NULL && win->w_buffer->b_help)
        help_window = TRUE;
     else
        clear_snapshot(curtab, SNAP_HELP_IDX);
@@ -2214,13 +2214,15 @@ win_close(win, free_buf)
 
 #ifdef FEAT_SYN_HL
     /* Free independent synblock before the buffer is freed. */
-    reset_synblock(win);
+    if (win->w_buffer != NULL)
+       reset_synblock(win);
 #endif
 
     /*
      * Close the link to the buffer.
      */
-    close_buffer(win, win->w_buffer, free_buf ? DOBUF_UNLOAD : 0);
+    if (win->w_buffer != NULL)
+       close_buffer(win, win->w_buffer, free_buf ? DOBUF_UNLOAD : 0);
 
     /* Autocommands may have closed the window already, or closed the only
      * other window or moved to another tab page. */