[Bug tui/30056] double free when using reverse-search for a previous command and Ctrl-C

["vries at gcc dot gnu.org" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=30056

Tom de Vries <vries at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
                 CC|                            |vries at gcc dot gnu.org
   Last reconfirmed|                            |2023-05-23
     Ever confirmed|0                           |1

--- Comment #1 from Tom de Vries <vries at gcc dot gnu.org> ---
This fixes it for me:
...
diff --git a/readline/readline/callback.c b/readline/readline/callback.c
index 93f23d97bc2..e2a97f7cee7 100644
--- a/readline/readline/callback.c
+++ b/readline/readline/callback.c
@@ -163,7 +163,7 @@ rl_callback_read_char (void)
       RL_CHECK_SIGNALS ();
       if  (RL_ISSTATE (RL_STATE_ISEARCH))
        {
-         eof = _rl_isearch_callback (_rl_iscxt);
+         eof = _rl_isearch_callback (&_rl_iscxt);
          if (eof == 0 && (RL_ISSTATE (RL_STATE_ISEARCH) == 0) && RL_ISSTATE
(RL_STATE_INPUTPENDING))
            rl_callback_read_char ();

diff --git a/readline/readline/isearch.c b/readline/readline/isearch.c
index 080ba3cbb9c..9f9b72d3b8e 100644
--- a/readline/readline/isearch.c
+++ b/readline/readline/isearch.c
@@ -877,14 +877,17 @@ rl_search_history (int direction, int invoking_key)
    If _rl_isearch_dispatch finishes searching, this function is responsible
    for turning off RL_STATE_ISEARCH, which it does using _rl_isearch_cleanup.
*/
 int
-_rl_isearch_callback (_rl_search_cxt *cxt)
+_rl_isearch_callback (_rl_search_cxt **cxt)
 {
   int c, r;

-  c = _rl_search_getchar (cxt);
+  c = _rl_search_getchar (*cxt);
+  if (*cxt == 0)
+    return 1;
   /* We might want to handle EOF here */
-  r = _rl_isearch_dispatch (cxt, cxt->lastc);
-
-  return (r <= 0) ? _rl_isearch_cleanup (cxt, r) : 0;
+  r = _rl_isearch_dispatch (*cxt, (*cxt)->lastc);
+  if (*cxt == 0)
+    return 1;
+  return (r <= 0) ? _rl_isearch_cleanup (*cxt, r) : 0;
 }
 #endif
diff --git a/readline/readline/rlprivate.h b/readline/readline/rlprivate.h
index 02838ae21ae..a549ec62607 100644
--- a/readline/readline/rlprivate.h
+++ b/readline/readline/rlprivate.h
@@ -306,7 +306,7 @@ extern _rl_search_cxt *_rl_scxt_alloc PARAMS((int, int));
 extern void _rl_scxt_dispose PARAMS((_rl_search_cxt *, int));

 extern int _rl_isearch_dispatch PARAMS((_rl_search_cxt *, int));
-extern int _rl_isearch_callback PARAMS((_rl_search_cxt *));
+extern int _rl_isearch_callback PARAMS((_rl_search_cxt **));
 extern int _rl_isearch_cleanup PARAMS((_rl_search_cxt *, int));

 extern int _rl_search_getchar PARAMS((_rl_search_cxt *));
...

-- 
You are receiving this mail because:
You are on the CC list for the bug.