diff options
| author | Nicholas Marriott <nicm@cvs.openbsd.org> | 2009-10-26 20:47:01 +0000 |
|---|---|---|
| committer | Nicholas Marriott <nicm@cvs.openbsd.org> | 2009-10-26 20:47:01 +0000 |
| commit | 3e1f8e92de0ce74e440d65b3a1ad2d6015f736d1 (patch) | |
| tree | 2612ca8b071e43782bc6cd1a6a3bc514b46e409f /usr.bin/tmux | |
| parent | de979dcf7ac047a8b1d687912e3f2849ae6b127d (diff) | |
Don't do anything in the client callback if the client has already died to
avoid a use-after-free (the callback is used twice, once for the client itself
and once for the tty). Fixes crashes seen by Han Boetes.
Diffstat (limited to 'usr.bin/tmux')
| -rw-r--r-- | usr.bin/tmux/server-client.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/usr.bin/tmux/server-client.c b/usr.bin/tmux/server-client.c index 3560db68f2c..1cbdb9680a7 100644 --- a/usr.bin/tmux/server-client.c +++ b/usr.bin/tmux/server-client.c @@ -1,4 +1,4 @@ -/* $OpenBSD: server-client.c,v 1.6 2009/10/25 22:00:15 nicm Exp $ */ +/* $OpenBSD: server-client.c,v 1.7 2009/10/26 20:47:00 nicm Exp $ */ /* * Copyright (c) 2009 Nicholas Marriott <nicm@users.sourceforge.net> @@ -153,6 +153,9 @@ server_client_callback(int fd, int events, void *data) { struct client *c = data; + if (c->flags & CLIENT_DEAD) + return; + if (fd == c->ibuf.fd) { if (events & (POLLERR|POLLNVAL|POLLHUP)) goto client_lost; |