Opened on 12/05/21 at 14:03:15
Closed on 01/31/23 at 05:20:41
#4564 closed defect (fixed)
close_editor problem of RTEMS4.13/5.1
Reported by: | chenjin_zhong | Owned by: | Chris Johns <chrisj@…> |
---|---|---|---|
Priority: | normal | Milestone: | 5.3 |
Component: | shell | Version: | 5 |
Severity: | normal | Keywords: | |
Cc: | Blocked By: | ||
Blocking: |
Description
Hi, I find when close editor in shell console.some errors will occur. I check and analyse the source code of medit.c. the code fragment is listed as follows.
#if defined(rtems)
case ctrl('w'): ed = ed->env->current; close_editor(ed); break;
#else
case ctrl('w'): close_editor(ed); ed = ed->env->current; break;
#endif
static void close_editor(struct editor *ed) {
struct env *env = ed->env;
if (ed->dirty) {
display_message(ed, "Close %s without saving changes (y/n)? ", ed->filename);
if (!ask()) {
ed->refresh = 1;
return;
}
}
delete_editor(ed);
ed = env->current;
if (!ed) {
ed = create_editor(env);
new_file(ed, "");
}
ed->refresh = 1;
}
static void delete_editor(struct editor *ed) {
if (ed->next == ed) {
ed->env->current = NULL;
} else {
ed->env->current = ed->prev;
}
ed->next->prev = ed->prev;
ed->prev->next = ed->next;
if (ed->start) free(ed->start);
clear_undo(ed);
free(ed);
}
as seen above, if the macro rtems is defined. the delete_editor function will free ed pointer. Therefore, after the next loop, the ed is an invalid pointer.I have checked the code of https://github.com/ringgaard/sanos/blob/master/src/utils/edit/edit.c. the code is as follows.
case ctrl('w'): close_editor(ed); ed = ed->env->current; break;
Change History (3)
comment:1 Changed on 11/10/22 at 00:52:24 by Chris Johns
Milestone: | 5.1 → 5.3 |
---|
comment:2 Changed on 01/30/23 at 02:39:45 by Chris Johns
comment:3 Changed on 01/31/23 at 05:20:41 by Chris Johns <chrisj@…>
Owner: | set to Chris Johns <chrisj@…> |
---|---|
Resolution: | → fixed |
Status: | new → closed |
In 45f60cf/rtems:
The original code is wrong and the change made by Joel due to Coverity is also wrong because the
ed
passed intoclose_editor()
is the next editor and not the one we want closed.