From 842bc2b855114984c6c182b83523d7268b8b2b0b Mon Sep 17 00:00:00 2001 From: Nicholas Marriott Date: Sat, 17 Apr 2010 23:14:17 +0000 Subject: [PATCH] Fix use-after-free of the window link when it is part of a grouped session (and hence could have been recreated), from Micah Cowan. --- cmd-join-pane.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/cmd-join-pane.c b/cmd-join-pane.c index 722a2031..acf9b754 100644 --- a/cmd-join-pane.c +++ b/cmd-join-pane.c @@ -151,13 +151,14 @@ cmd_join_pane_exec(struct cmd *self, struct cmd_ctx *ctx) struct winlink *src_wl, *dst_wl; struct window *src_w, *dst_w; struct window_pane *src_wp, *dst_wp; - int size; + int size, dst_idx; enum layout_type type; struct layout_cell *lc; if ((dst_wl = cmd_find_pane(ctx, data->dst, &dst_s, &dst_wp)) == NULL) return (-1); dst_w = dst_wl->window; + dst_idx = dst_wl->idx; if ((src_wl = cmd_find_pane(ctx, data->src, NULL, &src_wp)) == NULL) return (-1); @@ -210,7 +211,7 @@ cmd_join_pane_exec(struct cmd *self, struct cmd_ctx *ctx) if (!data->flag_detached) { window_set_active_pane(dst_w, src_wp); - session_select(dst_s, dst_wl->idx); + session_select(dst_s, dst_idx); server_redraw_session(dst_s); } else server_status_session(dst_s);