diff options
| author | Nicholas Marriott <nicm@openbsd.org> | 2010-04-17 23:14:17 +0000 |
|---|---|---|
| committer | Nicholas Marriott <nicm@openbsd.org> | 2010-04-17 23:14:17 +0000 |
| commit | 842bc2b855114984c6c182b83523d7268b8b2b0b (patch) | |
| tree | d0605da6ca1b359b1a88c1c975e2d993dd587e49 /cmd-join-pane.c | |
| parent | a2c86dcbf6464634ebbc63ef1cd2966b8ef132f9 (diff) | |
| download | rtmux-842bc2b855114984c6c182b83523d7268b8b2b0b.tar.gz rtmux-842bc2b855114984c6c182b83523d7268b8b2b0b.tar.bz2 rtmux-842bc2b855114984c6c182b83523d7268b8b2b0b.zip | |
Fix use-after-free of the window link when it is part of a grouped
session (and hence could have been recreated), from Micah Cowan.
Diffstat (limited to 'cmd-join-pane.c')
| -rw-r--r-- | cmd-join-pane.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/cmd-join-pane.c b/cmd-join-pane.c index 722a2031..acf9b754 100644 --- a/cmd-join-pane.c +++ b/cmd-join-pane.c @@ -151,13 +151,14 @@ cmd_join_pane_exec(struct cmd *self, struct cmd_ctx *ctx) struct winlink *src_wl, *dst_wl; struct window *src_w, *dst_w; struct window_pane *src_wp, *dst_wp; - int size; + int size, dst_idx; enum layout_type type; struct layout_cell *lc; if ((dst_wl = cmd_find_pane(ctx, data->dst, &dst_s, &dst_wp)) == NULL) return (-1); dst_w = dst_wl->window; + dst_idx = dst_wl->idx; if ((src_wl = cmd_find_pane(ctx, data->src, NULL, &src_wp)) == NULL) return (-1); @@ -210,7 +211,7 @@ cmd_join_pane_exec(struct cmd *self, struct cmd_ctx *ctx) if (!data->flag_detached) { window_set_active_pane(dst_w, src_wp); - session_select(dst_s, dst_wl->idx); + session_select(dst_s, dst_idx); server_redraw_session(dst_s); } else server_status_session(dst_s); |