circlecloud/tmux
1
0
Fork 0
mirror of https://github.com/tmux/tmux.git synced 2025-11-04 00:56:10 +00:00
Code Issues Projects Releases Wiki Activity

When replacing, don't free the old paste until after the new one's name

Browse Source 
has been copied. Fixes a use-after-free in window-copy.c. Bug reported
by J Raynor (who also provided a different fix).
This commit is contained in:
nicm
2015-04-07 13:06:22 +00:00
parent 3aa72b42b2
commit 6920be311b
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
paste.c
View File

@@ -247,9 +247,6 @@ paste_set(char *data, size_t size, const char *name, char **cause)
return (-1); return (-1);
} }
pb = paste_get_name(name);
if (pb != NULL)
paste_free_name(name);
pb = xmalloc(sizeof *pb); pb = xmalloc(sizeof *pb);
@@ -261,6 +258,9 @@ paste_set(char *data, size_t size, const char *name, char **cause)
pb->automatic = 0; pb->automatic = 0;
pb->order = paste_next_order++; pb->order = paste_next_order++;
if (paste_get_name(name) != NULL)
paste_free_name(name);
RB_INSERT(paste_name_tree, &paste_by_name, pb); RB_INSERT(paste_name_tree, &paste_by_name, pb);
RB_INSERT(paste_time_tree, &paste_by_time, pb); RB_INSERT(paste_time_tree, &paste_by_time, pb);