commit 1c3dd8ddcba63c1af5112e567215b3cec2de11d0
author Bram Moolenaar <Bram@vim.org> Sat Sep 17 19:43:23 2022 +0100
committer Bram Moolenaar <Bram@vim.org> Sat Sep 17 19:43:23 2022 +0100
tree af01369780ad70339d079d0a9297d3dfe2b037b6
parent fb593c5350e8fe23b608ded5a011cd7eefe73922

patch 9.0.0490: using freed memory with cmdwin and BufEnter autocmd

Problem:    Using freed memory with cmdwin and BufEnter autocmd.
Solution:   Make sure pointer to b_p_iminsert is still valid.

src/ex_getln.c

diff --git a/src/ex_getln.c b/src/ex_getln.c
index 70436b3..a4fb611 100644
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -1587,6 +1587,7 @@
 #endif
     expand_T	xpc;
     long	*b_im_ptr = NULL;
+    buf_T	*b_im_ptr_buf = NULL;	// buffer where b_im_ptr is valid
     cmdline_info_T save_ccline;
     int		did_save_ccline = FALSE;
     int		cmdline_type;
@@ -1683,6 +1684,7 @@
 	    b_im_ptr = &curbuf->b_p_iminsert;
 	else
 	    b_im_ptr = &curbuf->b_p_imsearch;
+	b_im_ptr_buf = curbuf;
 	if (*b_im_ptr == B_IMODE_LMAP)
 	    State |= MODE_LANGMAP;
 #ifdef HAVE_INPUT_METHOD
@@ -2034,7 +2036,8 @@
 		goto cmdline_not_changed;
 
 	case Ctrl_HAT:
-		cmdline_toggle_langmap(b_im_ptr);
+		cmdline_toggle_langmap(
+				    buf_valid(b_im_ptr_buf) ? b_im_ptr : NULL);
 		goto cmdline_not_changed;
 
 //	case '@':   only in very old vi
@@ -2544,7 +2547,8 @@
 #endif
 
 #ifdef HAVE_INPUT_METHOD
-    if (b_im_ptr != NULL && *b_im_ptr != B_IMODE_LMAP)
+    if (b_im_ptr != NULL && buf_valid(b_im_ptr_buf)
+						  && *b_im_ptr != B_IMODE_LMAP)
 	im_save_status(b_im_ptr);
     im_set_active(FALSE);
 #endif