diff options
| author | Nicholas Marriott <nicm@cvs.openbsd.org> | 2015-04-07 13:06:23 +0000 |
|---|---|---|
| committer | Nicholas Marriott <nicm@cvs.openbsd.org> | 2015-04-07 13:06:23 +0000 |
| commit | 4c5f42a02bc1d95a1115dd11e226bd69fca57bc9 (patch) | |
| tree | 5c331f1205e4f0127db2e145ef1050617c56defb | |
| parent | f0bfbc7854be173f583615aa192019befdeab9d7 (diff) | |
When replacing, don't free the old paste until after the new one's name
has been copied. Fixes a use-after-free in window-copy.c. Bug reported
by J Raynor (who also provided a different fix).
| -rw-r--r-- | usr.bin/tmux/paste.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/usr.bin/tmux/paste.c b/usr.bin/tmux/paste.c index c779048e149..2cf1678f3ef 100644 --- a/usr.bin/tmux/paste.c +++ b/usr.bin/tmux/paste.c @@ -1,4 +1,4 @@ -/* $OpenBSD: paste.c,v 1.26 2014/11/05 23:25:02 nicm Exp $ */ +/* $OpenBSD: paste.c,v 1.27 2015/04/07 13:06:22 nicm Exp $ */ /* * Copyright (c) 2007 Nicholas Marriott <nicm@users.sourceforge.net> @@ -247,9 +247,6 @@ paste_set(char *data, size_t size, const char *name, char **cause) return (-1); } - pb = paste_get_name(name); - if (pb != NULL) - paste_free_name(name); pb = xmalloc(sizeof *pb); @@ -261,6 +258,9 @@ paste_set(char *data, size_t size, const char *name, char **cause) pb->automatic = 0; pb->order = paste_next_order++; + if (paste_get_name(name) != NULL) + paste_free_name(name); + RB_INSERT(paste_name_tree, &paste_by_name, pb); RB_INSERT(paste_time_tree, &paste_by_time, pb); |