Fix potential crash when executing commands in bindings

[krobelus]

The function run_prompt_command may reallocate the array run_request,
invalidating the pointer to the current request if it was inside
run_request. The resulting use-after-free would cause occasional crashes.

Fixes #1001

[koutcher]

Great catch, thanks for tracking down the issue. As the problem is limited to the use of the flags in the end of exec_run_request(), I'd be more in favor of keeping a copy of the flags. Something like:

diff --git a/src/prompt.c b/src/prompt.c
index 506b32b..df20549 100644
--- a/src/prompt.c
+++ b/src/prompt.c
@@ -1096,6 +1096,7 @@ exec_run_request(struct view *view, struct run_request *req)
 	char cmd[SIZEOF_MED_STR];
 	const char *req_argv[SIZEOF_ARG];
 	int req_argc = 0;
+	struct run_request_flags req_flags = req->flags;
 
 	if (!argv_to_string(req->argv, cmd, sizeof(cmd), " ")
 	    || !argv_from_string_no_quotes(req_argv, &req_argc, cmd)
@@ -1132,13 +1133,13 @@ exec_run_request(struct view *view, struct run_request *req)
 	free(argv);
 
 	if (request == REQ_NONE) {
-		if (req->flags.confirm && !confirmed)
+		if (req_flags.confirm && !confirmed)
 			request = REQ_NONE;
 
-		else if (req->flags.exit)
+		else if (req_flags.exit)
 			request = REQ_QUIT;
 
-		else if (!req->flags.internal && watch_dirty(&view->watch))
+		else if (!req_flags.internal && watch_dirty(&view->watch))
 			request = REQ_REFRESH;
 
 	}

What do you think ?

[krobelus]

Yeah your fix is cleaner, let's do that instead; closing this.
Thank you!

[krobelus]

Reopening with your suggestion so this doesn't get lost.