vim-patch:8.0.1403: using freed buffer in grep command

Problem:    Using freed buffer in grep command. (gy741, Dominique Pelle)
Solution:   Lock the dummy buffer to avoid autocommands wiping it out.

https://github.com/vim/vim/commit/4fb921e388b9a042573ab06cce36e92874954197

1 files changed, 9 insertions, 4 deletions

diff --git a/src/nvim/quickfix.c b/src/nvim/quickfix.c
index ea2d13761c..1aeadcec4a 100644
--- a/src/nvim/quickfix.c
+++ b/src/nvim/quickfix.c
@@ -3909,6 +3909,7 @@ load_dummy_buffer (
   bufref_T newbuf_to_wipe;
   int failed = true;
   aco_save_T aco;
+  int readfile_result;
 
   // Allocate a buffer without putting it in the buffer list.
   newbuf = buflist_new(NULL, NULL, (linenr_T)1, BLN_DUMMY);
@@ -3922,7 +3923,9 @@ load_dummy_buffer (
 
   /* need to open the memfile before putting the buffer in a window */
   if (ml_open(newbuf) == OK) {
-    /* set curwin/curbuf to buf and save a few things */
+    // Make sure this buffer isn't wiped out by auto commands.
+    newbuf->b_locked++;
+    // set curwin/curbuf to buf and save a few things
     aucmd_prepbuf(&aco, newbuf);
 
     /* Need to set the filename for autocommands. */
@@ -3936,9 +3939,11 @@ load_dummy_buffer (
     curbuf->b_flags &= ~BF_DUMMY;
 
     newbuf_to_wipe.br_buf = NULL;
-    if (readfile(fname, NULL,
-            (linenr_T)0, (linenr_T)0, (linenr_T)MAXLNUM,
-            NULL, READ_NEW | READ_DUMMY) == OK
+    readfile_result = readfile(fname, NULL, (linenr_T)0, (linenr_T)0,
+                               (linenr_T)MAXLNUM, NULL,
+                               READ_NEW | READ_DUMMY);
+    newbuf->b_locked--;
+    if (readfile_result == OK
         && !got_int
         && !(curbuf->b_flags & BF_NEW)) {
       failed = FALSE;