From: Bram Moolenaar <Bram@vim.org>
Date: Sun, 3 Apr 2016 19:22:58 +0000 (+0200)
Subject: patch 7.4.1704
X-Git-Tag: v7.4.1704
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=3dda7db4e1f7c4a8110a1f83001ec36b46693d27;p=vim

patch 7.4.1704
Problem:    Using freed memory with "wincmd p". (Dominique Pelle)
Solution:   Also clear "prevwin" in other tab pages.
---

diff --git a/src/version.c b/src/version.c
index ea6d1c37e..58377a49e 100644
--- a/src/version.c
+++ b/src/version.c
@@ -748,6 +748,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1704,
 /**/
     1703,
 /**/
diff --git a/src/window.c b/src/window.c
index c7905aec5..bbd0a527c 100644
--- a/src/window.c
+++ b/src/window.c
@@ -340,7 +340,7 @@ newwindow:
 /* cursor to last accessed (previous) window */
     case 'p':
     case Ctrl_P:
-		if (prevwin == NULL)
+		if (!win_valid(prevwin))
 		    beep_flush();
 		else
 		    win_goto(prevwin);
@@ -4577,8 +4577,15 @@ win_free(
     unref_var_dict(wp->w_vars);
 #endif
 
-    if (prevwin == wp)
-	prevwin = NULL;
+    {
+	tabpage_T	*ttp;
+
+	if (prevwin == wp)
+	    prevwin = NULL;
+	for (ttp = first_tabpage; ttp != NULL; ttp = ttp->tp_next)
+	    if (ttp->tp_prevwin == wp)
+		ttp->tp_prevwin = NULL;
+    }
     win_free_lsize(wp);
 
     for (i = 0; i < wp->w_tagstacklen; ++i)