Permalink
Browse files

patch 8.0.0331: restoring help snapshot accesses freed memory

Problem:    Restoring help snapshot accesses freed memory. (Dominique Pelle)
Solution:   Don't restore a snapshot when the window closes.
  • Loading branch information...
brammool committed Feb 17, 2017
1 parent 84b2a38 commit 343b8c042967da82f2f022afa31f2c97a264c1c8
Showing with 17 additions and 2 deletions.
  1. +1 −0 src/Makefile
  2. +1 −0 src/testdir/Make_all.mak
  3. +10 −0 src/testdir/test_help.vim
  4. +2 −0 src/version.c
  5. +3 −2 src/window.c
View
@@ -2132,6 +2132,7 @@ test_arglist \
test_goto \
test_gui \
test_hardcopy \
+ test_help \
test_help_tagjump \
test_hide \
test_history \
View
@@ -154,6 +154,7 @@ NEW_TESTS = test_arglist.res \
test_gn.res \
test_gui.res \
test_hardcopy.res \
+ test_help.res \
test_hide.res \
test_history.res \
test_hlsearch.res \
View
@@ -0,0 +1,10 @@
+" Tests for :help
+
+func Test_help_restore_snapshot()
+ help
+ set buftype=
+ help
+ edit x
+ help
+ helpclose
+endfunc
View
@@ -764,6 +764,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 331,
/**/
330,
/**/
View
@@ -6551,7 +6551,7 @@ restore_snapshot(
/*
* Check if frames "sn" and "fr" have the same layout, same following frames
- * and same children.
+ * and same children. And the window pointer is valid.
*/
static int
check_snapshot_rec(frame_T *sn, frame_T *fr)
@@ -6562,7 +6562,8 @@ check_snapshot_rec(frame_T *sn, frame_T *fr)
|| (sn->fr_next != NULL
&& check_snapshot_rec(sn->fr_next, fr->fr_next) == FAIL)
|| (sn->fr_child != NULL
- && check_snapshot_rec(sn->fr_child, fr->fr_child) == FAIL))
+ && check_snapshot_rec(sn->fr_child, fr->fr_child) == FAIL)
+ || !win_valid(sn->fr_win))
return FAIL;
return OK;
}

0 comments on commit 343b8c0

Please sign in to comment.