diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2023-02-09 14:36:17 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-02-09 14:36:17 +0800 |
| commit | b2b82ff14281a4784790af288cde13984d5d5727 (patch) | |
| tree | c2ef45236fe7311eae8c32cd8cee58be7a590763 | |
| parent | ecc40660d1577835245d99f95e14762a30d36054 (diff) | |
| download | rneovim-b2b82ff14281a4784790af288cde13984d5d5727.tar.gz rneovim-b2b82ff14281a4784790af288cde13984d5d5727.tar.bz2 rneovim-b2b82ff14281a4784790af288cde13984d5d5727.zip | |
fix(rpc): ignore redraw events when exiting (#22184)
When a TUI client has already stopped, handling UI events will cause a
heap-use-after-free, so ignore them.
| -rw-r--r-- | src/nvim/msgpack_rpc/channel.c | 3 | ||||
| -rw-r--r-- | test/functional/terminal/tui_spec.lua | 5 |
2 files changed, 7 insertions, 1 deletions
diff --git a/src/nvim/msgpack_rpc/channel.c b/src/nvim/msgpack_rpc/channel.c index 193c88646a..34c8f89e3f 100644 --- a/src/nvim/msgpack_rpc/channel.c +++ b/src/nvim/msgpack_rpc/channel.c @@ -247,7 +247,8 @@ static void parse_msgpack(Channel *channel) Unpacker *p = channel->rpc.unpacker; while (unpacker_advance(p)) { if (p->type == kMessageTypeRedrawEvent) { - if (ui_client_channel_id) { + // When exiting, ui_client_stop() has already been called, so don't handle UI events. + if (ui_client_channel_id && !exiting) { if (p->grid_line_event) { ui_client_event_raw_line(p->grid_line_event); } else if (p->ui_handler.fn != NULL && p->result.type == kObjectTypeArray) { diff --git a/test/functional/terminal/tui_spec.lua b/test/functional/terminal/tui_spec.lua index 1d9e7b8e11..7294969ac8 100644 --- a/test/functional/terminal/tui_spec.lua +++ b/test/functional/terminal/tui_spec.lua @@ -2407,6 +2407,11 @@ describe("TUI as a client", function() {3:-- TERMINAL --} | ]]} + -- No heap-use-after-free when receiving UI events after deadly signal #22184 + server:request('nvim_input', ('a'):rep(1000)) + exec_lua([[vim.loop.kill(vim.fn.jobpid(vim.bo.channel), 'sigterm')]]) + screen:expect({any = '%[Process exited 1%]'}) + client_super:close() server:close() end) |