To: vim_dev@googlegroups.com
Subject: Patch 8.1.1649
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 8.1.1649
Problem:    Illegal memory access when closing popup window.
Solution:   Get w_next before closing the window.
Files:	    src/popupwin.c


*** ../vim-8.1.1648/src/popupwin.c	2019-07-07 18:27:52.361277159 +0200
--- src/popupwin.c	2019-07-07 20:41:29.302435483 +0200
***************
*** 1437,1442 ****
--- 1437,1443 ----
  
  	res.v_type = VAR_NUMBER;
  	res.vval.v_number = -2;
+ 	// Careful: this makes "wp" invalid.
  	popup_close_and_callback(wp, &res);
      }
  }
***************
*** 1447,1453 ****
      void
  popup_handle_mouse_moved(void)
  {
!     win_T   *wp;
      win_T   *mouse_wp;
      int	    row = mouse_row;
      int	    col = mouse_col;
--- 1448,1454 ----
      void
  popup_handle_mouse_moved(void)
  {
!     win_T   *wp, *nextwp;
      win_T   *mouse_wp;
      int	    row = mouse_row;
      int	    col = mouse_col;
***************
*** 1455,1464 ****
      // find the window where the mouse is in
      mouse_wp = mouse_find_win(&row, &col, FIND_POPUP);
  
!     for (wp = first_popupwin; wp != NULL; wp = wp->w_next)
  	check_mouse_moved(wp, mouse_wp);
!     for (wp = curtab->tp_first_popupwin; wp != NULL; wp = wp->w_next)
  	check_mouse_moved(wp, mouse_wp);
  }
  
  /*
--- 1456,1471 ----
      // find the window where the mouse is in
      mouse_wp = mouse_find_win(&row, &col, FIND_POPUP);
  
!     for (wp = first_popupwin; wp != NULL; wp = nextwp)
!     {
! 	nextwp = wp->w_next;
  	check_mouse_moved(wp, mouse_wp);
!     }
!     for (wp = curtab->tp_first_popupwin; wp != NULL; wp = nextwp)
!     {
! 	nextwp = wp->w_next;
  	check_mouse_moved(wp, mouse_wp);
+     }
  }
  
  /*
*** ../vim-8.1.1648/src/version.c	2019-07-07 20:30:43.518359624 +0200
--- src/version.c	2019-07-07 20:42:51.981929075 +0200
***************
*** 779,780 ****
--- 779,782 ----
  {   /* Add new patch number below this line */
+ /**/
+     1649,
  /**/

-- 
Vim is like Emacs without all the typing.  (John "Johann" Spetz)

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\  an exciting new programming language -- http://www.Zimbu.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///