The branch, master has been updated
       via  b4ad1759b8a35df6304ac94729314085dcc03d5e (commit)
       via  6589120667587f2d5c6f59f9faf4bda584a9f602 (commit)
      from  0cdcae35329dcf178d41cb036a914954b9ca7e01 (commit)

- Log -----------------------------------------------------------------
commit b4ad1759b8a35df6304ac94729314085dcc03d5e
Merge: 0cdcae3 6589120
Author: Thomas Adam <tho...@xteddy.org>
Commit: Thomas Adam <tho...@xteddy.org>

    Merge branch 'obsd-master'
    
    Sync from OpenBSD.

 window-choose.c |   13 +++++++------
 1 files changed, 7 insertions(+), 6 deletions(-)



commit 6589120667587f2d5c6f59f9faf4bda584a9f602
Author: Nicholas Marriott <n...@openbsd.org>
Commit: Nicholas Marriott <n...@openbsd.org>

    Fix a use-after-free when collapsing the tree in choose mode, from
    Carl Henrik Lunde.
---
 window-choose.c |   13 +++++++------
 1 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/window-choose.c b/window-choose.c
index 55f95de..019f412 100644
--- a/window-choose.c
+++ b/window-choose.c
@@ -181,8 +181,8 @@ window_choose_free(struct window_pane *wp)
        struct window_choose_mode_item  *item;
        u_int                            i;
 
-       for (i = 0; i < ARRAY_LENGTH(&data->list); i++) {
-               item = &ARRAY_ITEM(&data->list, i);
+       for (i = 0; i < ARRAY_LENGTH(&data->old_list); i++) {
+               item = &ARRAY_ITEM(&data->old_list, i);
                if (data->freefn != NULL && item->wcd != NULL)
                        data->freefn(item->wcd);
                free(item->name);
@@ -289,6 +289,7 @@ window_choose_collapse(struct window_pane *wp, struct 
session *s)
        if (!ARRAY_EMPTY(&list_copy)) {
                ARRAY_FREE(&data->list);
                ARRAY_CONCAT(&data->list, &list_copy);
+               ARRAY_FREE(&list_copy);
        }
 }
 
@@ -296,11 +297,11 @@ void
 window_choose_collapse_all(struct window_pane *wp)
 {
        struct window_choose_mode_data  *data = wp->modedata;
-       struct window_choose_mode_item  *item, *chosen;
-       struct session                  *s;
+       struct window_choose_mode_item  *item;
+       struct session                  *s, *chosen;
        u_int                            i;
 
-       chosen = &ARRAY_ITEM(&data->list, data->selected);
+       chosen = ARRAY_ITEM(&data->list, data->selected).wcd->session;
 
        RB_FOREACH(s, sessions, &sessions)
                window_choose_collapse(wp, s);
@@ -309,7 +310,7 @@ window_choose_collapse_all(struct window_pane *wp)
        for (i = 0; i < ARRAY_LENGTH(&data->list); i++) {
                item = &ARRAY_ITEM(&data->list, i);
 
-               if (chosen->wcd->session != item->wcd->tree_session)
+               if (chosen != item->wcd->tree_session)
                        continue;
 
                if (item->wcd->type & TREE_SESSION)


-----------------------------------------------------------------------

Summary of changes:
 window-choose.c |   13 +++++++------
 1 files changed, 7 insertions(+), 6 deletions(-)


hooks/post-receive
-- 
tmux

------------------------------------------------------------------------------
Don't let slow site performance ruin your business. Deploy New Relic APM
Deploy New Relic app performance management and know exactly
what is happening inside your Ruby, Python, PHP, Java, and .NET app
Try New Relic at no cost today and get our sweet Data Nerd shirt too!
http://p.sf.net/sfu/newrelic-dev2dev
_______________________________________________
tmux-cvs mailing list
tmux-cvs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tmux-cvs

Reply via email to