If remain-on-exit is set, both the error callback and a SIGCHLD could

destroy the same pane (because the first one doesn't remove it from the
list of panes), causing the pane bufferevent to be freed twice. So don't
free it if the fd has already been set to -1, from Romain Francoise.

1 files changed, 5 insertions, 3 deletions

diff --git a/server-fn.c b/server-fn.c
index 86d7ffdd..01e78ba2 100644
--- a/server-fn.c
+++ b/server-fn.c
@@ -325,9 +325,11 @@ server_destroy_pane(struct window_pane *wp)
 {
 	struct window	*w = wp->window;
 
-	close(wp->fd);
-	bufferevent_free(wp->event);
-	wp->fd = -1;
+	if (wp->fd != -1) {
+		close(wp->fd);
+		bufferevent_free(wp->event);
+		wp->fd = -1;
+	}
 
 	if (options_get_number(&w->options, "remain-on-exit"))
 		return;