circlecloud
/
tmux
mirror of https://github.com/tmux/tmux.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

When replacing, don't free the old paste until after the new one's name 

has been copied. Fixes a use-after-free in window-copy.c. Bug reported
by J Raynor (who also provided a different fix).
pull/1/head
nicm 2015-04-07 13:06:22 +00:00
parent 3aa72b42b2
commit 6920be311b
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
paste.c
View File

@ -247,9 +247,6 @@ paste_set(char *data, size_t size, const char *name, char **cause)
return (-1);
}
pb = paste_get_name(name);
if (pb != NULL)
paste_free_name(name);
pb = xmalloc(sizeof *pb);
@ -261,6 +258,9 @@ paste_set(char *data, size_t size, const char *name, char **cause)
pb->automatic = 0;
pb->order = paste_next_order++;
if (paste_get_name(name) != NULL)
paste_free_name(name);
RB_INSERT(paste_name_tree, &paste_by_name, pb);
RB_INSERT(paste_time_tree, &paste_by_time, pb);