mirror of
				https://github.com/tmux/tmux.git
				synced 2025-11-04 00:56:10 +00:00 
			
		
		
		
	Take a reference to prevent cmdq being freed during the command. Can
happen to cfg_cmd_q (possibly others) when source-file recurses into cmdq_continue. Fixes bug reported by Ismail Donmez and Theo Buehler.
This commit is contained in:
		@@ -163,6 +163,7 @@ cmdq_continue(struct cmd_q *cmdq)
 | 
				
			|||||||
	int			 empty, flags;
 | 
						int			 empty, flags;
 | 
				
			||||||
	char			 s[1024];
 | 
						char			 s[1024];
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 | 
						cmdq->references++;
 | 
				
			||||||
	notify_disable();
 | 
						notify_disable();
 | 
				
			||||||
 | 
					
 | 
				
			||||||
	empty = TAILQ_EMPTY(&cmdq->queue);
 | 
						empty = TAILQ_EMPTY(&cmdq->queue);
 | 
				
			||||||
@@ -220,11 +221,13 @@ empty:
 | 
				
			|||||||
	if (cmdq->client_exit > 0)
 | 
						if (cmdq->client_exit > 0)
 | 
				
			||||||
		cmdq->client->flags |= CLIENT_EXIT;
 | 
							cmdq->client->flags |= CLIENT_EXIT;
 | 
				
			||||||
	if (cmdq->emptyfn != NULL)
 | 
						if (cmdq->emptyfn != NULL)
 | 
				
			||||||
		cmdq->emptyfn(cmdq); /* may free cmdq */
 | 
							cmdq->emptyfn(cmdq);
 | 
				
			||||||
	empty = 1;
 | 
						empty = 1;
 | 
				
			||||||
 | 
					
 | 
				
			||||||
out:
 | 
					out:
 | 
				
			||||||
	notify_enable();
 | 
						notify_enable();
 | 
				
			||||||
 | 
						cmdq_free(cmdq);
 | 
				
			||||||
 | 
					
 | 
				
			||||||
	return (empty);
 | 
						return (empty);
 | 
				
			||||||
}
 | 
					}
 | 
				
			||||||
 | 
					
 | 
				
			||||||
 
 | 
				
			|||||||
		Reference in New Issue
	
	Block a user