diff options
| author |   nicm <nicm@openbsd.org> | 2015-04-07 13:06:22 +0000 |
|---|---|---|
| committer | nicm <nicm@openbsd.org> | 2015-04-07 13:06:22 +0000 |
| commit | 0d382a955f2694ed34ea25446a7af15c4e06fab4 (patch) | |
| tree | 0221bfcf9f19bd7e1d322554f742eb13d2a8dbd3 /usr.bin/tmux/paste.c | |
| parent | nothing uses pool_sleep, so get rid of it (diff) | |
| download | wireguard-openbsd-0d382a955f2694ed34ea25446a7af15c4e06fab4.tar.xz wireguard-openbsd-0d382a955f2694ed34ea25446a7af15c4e06fab4.zip | |
When replacing, don't free the old paste until after the new one's name
has been copied. Fixes a use-after-free in window-copy.c. Bug reported
by J Raynor (who also provided a different fix).
Diffstat (limited to 'usr.bin/tmux/paste.c')
| -rw-r--r-- | usr.bin/tmux/paste.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/usr.bin/tmux/paste.c b/usr.bin/tmux/paste.c index c779048e149..2cf1678f3ef 100644 --- a/usr.bin/tmux/paste.c +++ b/usr.bin/tmux/paste.c @@ -1,4 +1,4 @@ -/* $OpenBSD: paste.c,v 1.26 2014/11/05 23:25:02 nicm Exp $ */ +/* $OpenBSD: paste.c,v 1.27 2015/04/07 13:06:22 nicm Exp $ */ /* * Copyright (c) 2007 Nicholas Marriott <nicm@users.sourceforge.net> @@ -247,9 +247,6 @@ paste_set(char *data, size_t size, const char *name, char **cause) return (-1); } - pb = paste_get_name(name); - if (pb != NULL) - paste_free_name(name); pb = xmalloc(sizeof *pb); @@ -261,6 +258,9 @@ paste_set(char *data, size_t size, const char *name, char **cause) pb->automatic = 0; pb->order = paste_next_order++; + if (paste_get_name(name) != NULL) + paste_free_name(name); + RB_INSERT(paste_name_tree, &paste_by_name, pb); RB_INSERT(paste_time_tree, &paste_by_time, pb); |