diff options
| author |   nicm <nicm@openbsd.org> | 2009-10-11 10:39:27 +0000 |
|---|---|---|
| committer | nicm <nicm@openbsd.org> | 2009-10-11 10:39:27 +0000 |
| commit | cc715dca03366893aa1d1a69926e8dc41bea4208 (patch) | |
| tree | 8498d9c7e1d6edc22217a46550c140c299c75a6e | |
| parent | Add support for the Broadcom BCM5717 ASIC and the BCM5717 / BCM5718 chipsets. (diff) | |
| download | wireguard-openbsd-cc715dca03366893aa1d1a69926e8dc41bea4208.tar.xz wireguard-openbsd-cc715dca03366893aa1d1a69926e8dc41bea4208.zip | |
Set the current window pointer to NULL when killing a winlink that is to be
replaced with link-window -k. This prevents it being pushed onto the last
window stack and causing a use-after-free.
Only took me an hour to find this :-/...
| -rw-r--r-- | usr.bin/tmux/server-fn.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/usr.bin/tmux/server-fn.c b/usr.bin/tmux/server-fn.c index 78cc1ba5fa4..bfcc8111b1d 100644 --- a/usr.bin/tmux/server-fn.c +++ b/usr.bin/tmux/server-fn.c @@ -1,4 +1,4 @@ -/* $OpenBSD: server-fn.c,v 1.25 2009/10/10 10:02:48 nicm Exp $ */ +/* $OpenBSD: server-fn.c,v 1.26 2009/10/11 10:39:27 nicm Exp $ */ /* * Copyright (c) 2007 Nicholas Marriott <nicm@users.sourceforge.net> @@ -284,8 +284,10 @@ server_link_window(struct session *src, struct winlink *srcwl, winlink_remove(&dst->windows, dstwl); /* Force select/redraw if current. */ - if (dstwl == dst->curw) + if (dstwl == dst->curw) { selectflag = 1; + dst->curw = NULL; + } } } |