From 42e24139788d76f00896005df0f745d9e022709a Mon Sep 17 00:00:00 2001
From: Nicholas Marriott <nicm@openbsd.org>
Date: Sat, 26 Jun 2010 18:20:53 +0000
Subject: [PATCH] Setting the cmdlist pointer in the bind-key to NULL to
 prevent it being freed after the command is executing is bogus because it may
 still be needed if the same command is going to be executed again (for
 example if you "bind-key a bind-key b ..."). Making a copy is hard, so
 instead add a reference count to the cmd_list.

While here, also print bind-key -n and the rest of the flags properly.

Fixes problem reported by mcbride@.
---
 cmd-bind-key.c | 13 +++++++++++--
 cmd-list.c     | 20 ++++++++++++--------
 key-bindings.c |  7 ++++---
 tmux.c         |  2 +-
 tmux.h         |  5 ++++-
 5 files changed, 32 insertions(+), 15 deletions(-)

diff --git a/cmd-bind-key.c b/cmd-bind-key.c
index c535612f..60887904 100644
--- a/cmd-bind-key.c
+++ b/cmd-bind-key.c
@@ -130,7 +130,7 @@ cmd_bind_key_exec(struct cmd *self, unused struct cmd_ctx *ctx)
 		return (cmd_bind_key_table(self, ctx));
 
 	key_bindings_add(data->key, data->can_repeat, data->cmdlist);
-	data->cmdlist = NULL;	/* avoid free */
+	data->cmdlist->references++;
 
 	return (0);
 }
@@ -192,8 +192,17 @@ cmd_bind_key_print(struct cmd *self, char *buf, size_t len)
 	off += xsnprintf(buf, len, "%s", self->entry->name);
 	if (data == NULL)
 		return (off);
+
+	if (off < len && data->command_key)
+		off += xsnprintf(buf + off, len - off, " -c");
+	if (off < len && !(data->key & KEYC_PREFIX))
+		off += xsnprintf(buf + off, len - off, " -n");
+	if (off < len && data->can_repeat)
+		off += xsnprintf(buf + off, len - off, " -r");
+	if (off < len && data->tablename != NULL)
+		off += cmd_prarg(buf + off, len - off, " -t ", data->tablename);
 	if (off < len) {
-		skey = key_string_lookup_key(data->key);
+		skey = key_string_lookup_key(data->key & ~KEYC_PREFIX);
 		off += xsnprintf(buf + off, len - off, " %s ", skey);
 	}
 	if (off < len)
diff --git a/cmd-list.c b/cmd-list.c
index 55550c21..181127ae 100644
--- a/cmd-list.c
+++ b/cmd-list.c
@@ -32,7 +32,8 @@ cmd_list_parse(int argc, char **argv, char **cause)
 	char	       **new_argv;
 
 	cmdlist = xmalloc(sizeof *cmdlist);
-	TAILQ_INIT(cmdlist);
+	cmdlist->references = 1;
+	TAILQ_INIT(&cmdlist->list);
 
 	lastsplit = 0;
 	for (i = 0; i < argc; i++) {
@@ -54,7 +55,7 @@ cmd_list_parse(int argc, char **argv, char **cause)
 		cmd = cmd_parse(new_argc, new_argv, cause);
 		if (cmd == NULL)
 			goto bad;
-		TAILQ_INSERT_TAIL(cmdlist, cmd, qentry);
+		TAILQ_INSERT_TAIL(&cmdlist->list, cmd, qentry);
 
 		lastsplit = i + 1;
 	}
@@ -63,7 +64,7 @@ cmd_list_parse(int argc, char **argv, char **cause)
 		cmd = cmd_parse(argc - lastsplit, argv + lastsplit, cause);
 		if (cmd == NULL)
 			goto bad;
-		TAILQ_INSERT_TAIL(cmdlist, cmd, qentry);
+		TAILQ_INSERT_TAIL(&cmdlist->list, cmd, qentry);
 	}
 
 	return (cmdlist);
@@ -80,7 +81,7 @@ cmd_list_exec(struct cmd_list *cmdlist, struct cmd_ctx *ctx)
 	int		 n, retval;
 
 	retval = 0;
-	TAILQ_FOREACH(cmd, cmdlist, qentry) {
+	TAILQ_FOREACH(cmd, &cmdlist->list, qentry) {
 		if ((n = cmd_exec(cmd, ctx)) == -1)
 			return (-1);
 
@@ -114,9 +115,12 @@ cmd_list_free(struct cmd_list *cmdlist)
 {
 	struct cmd	*cmd;
 
-	while (!TAILQ_EMPTY(cmdlist)) {
-		cmd = TAILQ_FIRST(cmdlist);
-		TAILQ_REMOVE(cmdlist, cmd, qentry);
+	if (--cmdlist->references != 0)
+		return;
+
+	while (!TAILQ_EMPTY(&cmdlist->list)) {
+		cmd = TAILQ_FIRST(&cmdlist->list);
+		TAILQ_REMOVE(&cmdlist->list, cmd, qentry);
 		cmd_free(cmd);
 	}
 	xfree(cmdlist);
@@ -129,7 +133,7 @@ cmd_list_print(struct cmd_list *cmdlist, char *buf, size_t len)
 	size_t		 off;
 
 	off = 0;
-	TAILQ_FOREACH(cmd, cmdlist, qentry) {
+	TAILQ_FOREACH(cmd, &cmdlist->list, qentry) {
 		if (off >= len)
 			break;
 		off += cmd_print(cmd, buf + off, len - off);
diff --git a/key-bindings.c b/key-bindings.c
index ac4039f9..2a039af0 100644
--- a/key-bindings.c
+++ b/key-bindings.c
@@ -178,14 +178,15 @@ key_bindings_init(void)
 
 	for (i = 0; i < nitems(table); i++) {
 		cmdlist = xmalloc(sizeof *cmdlist);
-		TAILQ_INIT(cmdlist);
+		TAILQ_INIT(&cmdlist->list);
+		cmdlist->references = 1;
 
 		cmd = xmalloc(sizeof *cmd);
 		cmd->entry = table[i].entry;
 		cmd->data = NULL;
 		if (cmd->entry->init != NULL)
 			cmd->entry->init(cmd, table[i].key);
-		TAILQ_INSERT_HEAD(cmdlist, cmd, qentry);
+		TAILQ_INSERT_HEAD(&cmdlist->list, cmd, qentry);
 
 		key_bindings_add(
 		    table[i].key | KEYC_PREFIX, table[i].can_repeat, cmdlist);
@@ -259,7 +260,7 @@ key_bindings_dispatch(struct key_binding *bd, struct client *c)
 	ctx.cmdclient = NULL;
 
 	readonly = 1;
-	TAILQ_FOREACH(cmd, bd->cmdlist, qentry) {
+	TAILQ_FOREACH(cmd, &bd->cmdlist->list, qentry) {
 		if (!(cmd->entry->flags & CMD_READONLY))
 			readonly = 0;
 	}
diff --git a/tmux.c b/tmux.c
index 28f822ce..f85a3556 100644
--- a/tmux.c
+++ b/tmux.c
@@ -517,7 +517,7 @@ main(int argc, char **argv)
 			exit(1);
 		}
 		cmdflags &= ~CMD_STARTSERVER;
-		TAILQ_FOREACH(cmd, cmdlist, qentry) {
+		TAILQ_FOREACH(cmd, &cmdlist->list, qentry) {
 			if (cmd->entry->flags & CMD_STARTSERVER)
 				cmdflags |= CMD_STARTSERVER;
 			if (cmd->entry->flags & CMD_SENDENVIRON)
diff --git a/tmux.h b/tmux.h
index 7d6c2e70..6b158cd7 100644
--- a/tmux.h
+++ b/tmux.h
@@ -1161,7 +1161,10 @@ struct cmd {
 
 	TAILQ_ENTRY(cmd) qentry;
 };
-TAILQ_HEAD(cmd_list, cmd);
+struct cmd_list {
+	int		 references;
+	TAILQ_HEAD(, cmd) list;
+};
 
 struct cmd_entry {
 	const char	*name;