patch 8.1.1649: Illegal memory access when closing popup window
Problem: Illegal memory access when closing popup window.
Solution: Get w_next before closing the window.
diff --git a/src/popupwin.c b/src/popupwin.c
index 401f1fb..32f4861 100644
--- a/src/popupwin.c
+++ b/src/popupwin.c
@@ -1437,6 +1437,7 @@
res.v_type = VAR_NUMBER;
res.vval.v_number = -2;
+ // Careful: this makes "wp" invalid.
popup_close_and_callback(wp, &res);
}
}
@@ -1447,7 +1448,7 @@
void
popup_handle_mouse_moved(void)
{
- win_T *wp;
+ win_T *wp, *nextwp;
win_T *mouse_wp;
int row = mouse_row;
int col = mouse_col;
@@ -1455,10 +1456,16 @@
// find the window where the mouse is in
mouse_wp = mouse_find_win(&row, &col, FIND_POPUP);
- for (wp = first_popupwin; wp != NULL; wp = wp->w_next)
+ for (wp = first_popupwin; wp != NULL; wp = nextwp)
+ {
+ nextwp = wp->w_next;
check_mouse_moved(wp, mouse_wp);
- for (wp = curtab->tp_first_popupwin; wp != NULL; wp = wp->w_next)
+ }
+ for (wp = curtab->tp_first_popupwin; wp != NULL; wp = nextwp)
+ {
+ nextwp = wp->w_next;
check_mouse_moved(wp, mouse_wp);
+ }
}
/*