circlecloud
/
tmux
mirror of https://github.com/tmux/tmux.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Double-free on session destroy.

pull/1/head
Nicholas Marriott 2007-11-12 16:39:30 +00:00
parent 577bd45719
commit 765a224b30
2 changed files with 6 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
TODO
View File

@ -22,8 +22,8 @@
- client could pass term/tty fd up to server and then do nothing. what problems - client could pass term/tty fd up to server and then do nothing. what problems
would this cause? -- need access to all terminfo data at once... signals? would this cause? -- need access to all terminfo data at once... signals?
- cleanup/redesign IPC - cleanup/redesign IPC
IPC is arse-about-face: too much overhead. 8-byte header for each IPC is slightly arse-about-face: too much overhead. 8-byte header for
packet... hrm. already scanning output for \e, could add an extra each packet... hrm. already scanning output for \e, could add an extra
byte to it for message byte to it for message
- could use bsearch all over the place or get rid of smaller tables (clientmsg) - could use bsearch all over the place or get rid of smaller tables (clientmsg)
- better errors when creating new windows/sessions (how?) - better errors when creating new windows/sessions (how?)

12
session.c
View File

@ -1,4 +1,4 @@
/* $Id: session.c,v 1.28 2007-10-31 14:26:26 nicm Exp $ */ /* $Id: session.c,v 1.29 2007-11-12 16:39:30 nicm Exp $ */
/* /*
* Copyright (c) 2007 Nicholas Marriott <nicm@users.sourceforge.net> * Copyright (c) 2007 Nicholas Marriott <nicm@users.sourceforge.net>
@ -124,8 +124,7 @@ session_create(const char *name, const char *cmd, u_int sx, u_int sy)
void void
session_destroy(struct session *s) session_destroy(struct session *s)
{ {
struct winlink *wl; u_int i;
u_int i;
if (session_index(s, &i) != 0) if (session_index(s, &i) != 0)
fatalx("session not found"); fatalx("session not found");
@ -133,11 +132,8 @@ session_destroy(struct session *s)
while (!ARRAY_EMPTY(&sessions) && ARRAY_LAST(&sessions) == NULL) while (!ARRAY_EMPTY(&sessions) && ARRAY_LAST(&sessions) == NULL)
ARRAY_TRUNC(&sessions, 1); ARRAY_TRUNC(&sessions, 1);
while (!RB_EMPTY(&s->windows)) { while (!RB_EMPTY(&s->windows))
wl = RB_ROOT(&s->windows); winlink_remove(&s->windows, RB_ROOT(&s->windows));
RB_REMOVE(winlinks, &s->windows, wl);
winlink_remove(&s->windows, wl);
}
xfree(s->name); xfree(s->name);
xfree(s); xfree(s);