The branch, master has been updated via b4ad1759b8a35df6304ac94729314085dcc03d5e (commit) via 6589120667587f2d5c6f59f9faf4bda584a9f602 (commit) from 0cdcae35329dcf178d41cb036a914954b9ca7e01 (commit)
- Log ----------------------------------------------------------------- commit b4ad1759b8a35df6304ac94729314085dcc03d5e Merge: 0cdcae3 6589120 Author: Thomas Adam <tho...@xteddy.org> Commit: Thomas Adam <tho...@xteddy.org> Merge branch 'obsd-master' Sync from OpenBSD. window-choose.c | 13 +++++++------ 1 files changed, 7 insertions(+), 6 deletions(-) commit 6589120667587f2d5c6f59f9faf4bda584a9f602 Author: Nicholas Marriott <n...@openbsd.org> Commit: Nicholas Marriott <n...@openbsd.org> Fix a use-after-free when collapsing the tree in choose mode, from Carl Henrik Lunde. --- window-choose.c | 13 +++++++------ 1 files changed, 7 insertions(+), 6 deletions(-) diff --git a/window-choose.c b/window-choose.c index 55f95de..019f412 100644 --- a/window-choose.c +++ b/window-choose.c @@ -181,8 +181,8 @@ window_choose_free(struct window_pane *wp) struct window_choose_mode_item *item; u_int i; - for (i = 0; i < ARRAY_LENGTH(&data->list); i++) { - item = &ARRAY_ITEM(&data->list, i); + for (i = 0; i < ARRAY_LENGTH(&data->old_list); i++) { + item = &ARRAY_ITEM(&data->old_list, i); if (data->freefn != NULL && item->wcd != NULL) data->freefn(item->wcd); free(item->name); @@ -289,6 +289,7 @@ window_choose_collapse(struct window_pane *wp, struct session *s) if (!ARRAY_EMPTY(&list_copy)) { ARRAY_FREE(&data->list); ARRAY_CONCAT(&data->list, &list_copy); + ARRAY_FREE(&list_copy); } } @@ -296,11 +297,11 @@ void window_choose_collapse_all(struct window_pane *wp) { struct window_choose_mode_data *data = wp->modedata; - struct window_choose_mode_item *item, *chosen; - struct session *s; + struct window_choose_mode_item *item; + struct session *s, *chosen; u_int i; - chosen = &ARRAY_ITEM(&data->list, data->selected); + chosen = ARRAY_ITEM(&data->list, data->selected).wcd->session; RB_FOREACH(s, sessions, &sessions) window_choose_collapse(wp, s); @@ -309,7 +310,7 @@ window_choose_collapse_all(struct window_pane *wp) for (i = 0; i < ARRAY_LENGTH(&data->list); i++) { item = &ARRAY_ITEM(&data->list, i); - if (chosen->wcd->session != item->wcd->tree_session) + if (chosen != item->wcd->tree_session) continue; if (item->wcd->type & TREE_SESSION) ----------------------------------------------------------------------- Summary of changes: window-choose.c | 13 +++++++------ 1 files changed, 7 insertions(+), 6 deletions(-) hooks/post-receive -- tmux ------------------------------------------------------------------------------ Don't let slow site performance ruin your business. Deploy New Relic APM Deploy New Relic app performance management and know exactly what is happening inside your Ruby, Python, PHP, Java, and .NET app Try New Relic at no cost today and get our sweet Data Nerd shirt too! http://p.sf.net/sfu/newrelic-dev2dev _______________________________________________ tmux-cvs mailing list tmux-cvs@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/tmux-cvs