diff options
| author | Nicholas Marriott <nicm@openbsd.org> | 2009-10-11 10:39:27 +0000 |
|---|---|---|
| committer | Nicholas Marriott <nicm@openbsd.org> | 2009-10-11 10:39:27 +0000 |
| commit | fbb030d7f767513aa9b646c67cab4659599682d3 (patch) | |
| tree | 8abb7116aa8ff877f1cfaa38da84e2fa9c72fea3 /server-fn.c | |
| parent | 64b5f39656f02a7c4cc6d5d4690c9b0ccc3f6c15 (diff) | |
Set the current window pointer to NULL when killing a winlink that is to be
replaced with link-window -k. This prevents it being pushed onto the last
window stack and causing a use-after-free.
Only took me an hour to find this :-/...
Diffstat (limited to 'server-fn.c')
| -rw-r--r-- | server-fn.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/server-fn.c b/server-fn.c index beaae07a..f4f71980 100644 --- a/server-fn.c +++ b/server-fn.c @@ -284,8 +284,10 @@ server_link_window(struct session *src, struct winlink *srcwl, winlink_remove(&dst->windows, dstwl); /* Force select/redraw if current. */ - if (dstwl == dst->curw) + if (dstwl == dst->curw) { selectflag = 1; + dst->curw = NULL; + } } } |