From 105a72eabc6f74195b6319471344148726683b9d Mon Sep 17 00:00:00 2001
From: Thiago de Arruda <tpadilha84@gmail.com>
Date: Fri, 21 Aug 2015 23:53:48 -0300
Subject: terminal: Fix use after free

Since close_cb may free the terminal structure, save the "wipe" flag before
calling it.
---
 src/nvim/terminal.c                          |  3 ++-
 test/functional/terminal/scrollback_spec.lua | 11 +++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/nvim/terminal.c b/src/nvim/terminal.c
index 931105717b..98fc44c133 100644
--- a/src/nvim/terminal.c
+++ b/src/nvim/terminal.c
@@ -422,8 +422,9 @@ end:
   redraw(term->buf != curbuf);
   ui_busy_stop();
   if (close) {
+    bool wipe = term->buf != NULL;
     term->opts.close_cb(term->opts.data);
-    if (term->buf) {
+    if (wipe) {
       do_cmdline_cmd("bwipeout!");
     }
   }
diff --git a/test/functional/terminal/scrollback_spec.lua b/test/functional/terminal/scrollback_spec.lua
index f2381631a9..87cc9a8266 100644
--- a/test/functional/terminal/scrollback_spec.lua
+++ b/test/functional/terminal/scrollback_spec.lua
@@ -343,6 +343,17 @@ describe('terminal prints more lines than the screen height and exits', function
       [Program exited, press any key to close]          |
       -- TERMINAL --                                    |
     ]])
+    feed('<cr>')
+    -- closes the buffer correctly after pressing a key
+    screen:expect([[
+      ^                                                  |
+      ~                                                 |
+      ~                                                 |
+      ~                                                 |
+      ~                                                 |
+      ~                                                 |
+                                                        |
+    ]])
   end)
 end)
 
-- 
cgit