if-shell doesn't need to queue its error message into a callback, and in

fact it can't do so because the item it was working with will have been
freed. Reported by Daniel Hahler.

1 files changed, 5 insertions, 17 deletions

diff --git a/usr.bin/tmux/cmd-if-shell.c b/usr.bin/tmux/cmd-if-shell.c
index 52c0aefe34a..1ec6c25a522 100644
--- a/usr.bin/tmux/cmd-if-shell.c
+++ b/usr.bin/tmux/cmd-if-shell.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: cmd-if-shell.c,v 1.55 2017/04/22 10:22:39 nicm Exp $ */
+/* $OpenBSD: cmd-if-shell.c,v 1.56 2017/04/25 11:49:35 nicm Exp $ */
 
 /*
  * Copyright (c) 2009 Tiago Cunha <me@tiagocunha.org>
@@ -31,7 +31,6 @@
 
 static enum cmd_retval	cmd_if_shell_exec(struct cmd *, struct cmdq_item *);
 
-static enum cmd_retval	cmd_if_shell_error(struct cmdq_item *, void *);
 static void		cmd_if_shell_callback(struct job *);
 static void		cmd_if_shell_free(void *);
 
@@ -138,17 +137,6 @@ cmd_if_shell_exec(struct cmd *self, struct cmdq_item *item)
 	return (CMD_RETURN_WAIT);
 }
 
-static enum cmd_retval
-cmd_if_shell_error(struct cmdq_item *item, void *data)
-{
-	char	*error = data;
-
-	cmdq_error(item, "%s", error);
-	free(error);
-
-	return (CMD_RETURN_NORMAL);
-}
-
 static void
 cmd_if_shell_callback(struct job *job)
 {
@@ -168,10 +156,10 @@ cmd_if_shell_callback(struct job *job)
 
 	cmdlist = cmd_string_parse(cmd, file, line, &cause);
 	if (cmdlist == NULL) {
-		if (cause != NULL)
-			new_item = cmdq_get_callback(cmd_if_shell_error, cause);
-		else
-			new_item = NULL;
+		if (cause != NULL && cdata->item != NULL)
+			cmdq_error(cdata->item, "%s", cause);
+		free(cause);
+		new_item = NULL;
 	} else {
 		new_item = cmdq_get_command(cmdlist, NULL, &cdata->mouse, 0);
 		cmd_list_free(cmdlist);