diff options
| author | Nicholas Marriott <nicm@cvs.openbsd.org> | 2015-02-12 09:56:20 +0000 |
|---|---|---|
| committer | Nicholas Marriott <nicm@cvs.openbsd.org> | 2015-02-12 09:56:20 +0000 |
| commit | 47b6b8168f54be4e3d5708ba5fd6ae26e7624a4c (patch) | |
| tree | bbe52b2dc304a55104118a2710b27d5ca80ac118 /usr.bin/tmux | |
| parent | 58e438bb583e8f9bf4979d0900b454112a97002e (diff) | |
Take a reference to prevent cmdq being freed during the command. Can
happen to cfg_cmd_q (possibly others) when source-file recurses into
cmdq_continue. Fixes bug reported by Ismail Donmez and Theo Buehler.
Diffstat (limited to 'usr.bin/tmux')
| -rw-r--r-- | usr.bin/tmux/cmd-queue.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/usr.bin/tmux/cmd-queue.c b/usr.bin/tmux/cmd-queue.c index d357fca1daa..bd400d70080 100644 --- a/usr.bin/tmux/cmd-queue.c +++ b/usr.bin/tmux/cmd-queue.c @@ -1,4 +1,4 @@ -/* $OpenBSD: cmd-queue.c,v 1.21 2015/02/05 10:26:29 nicm Exp $ */ +/* $OpenBSD: cmd-queue.c,v 1.22 2015/02/12 09:56:19 nicm Exp $ */ /* * Copyright (c) 2013 Nicholas Marriott <nicm@users.sourceforge.net> @@ -163,6 +163,7 @@ cmdq_continue(struct cmd_q *cmdq) int empty, flags; char s[1024]; + cmdq->references++; notify_disable(); empty = TAILQ_EMPTY(&cmdq->queue); @@ -220,11 +221,13 @@ empty: if (cmdq->client_exit > 0) cmdq->client->flags |= CLIENT_EXIT; if (cmdq->emptyfn != NULL) - cmdq->emptyfn(cmdq); /* may free cmdq */ + cmdq->emptyfn(cmdq); empty = 1; out: notify_enable(); + cmdq_free(cmdq); + return (empty); } |