patch 9.2.0899: command output temporary files may collide

Problem:  On MS-Windows, get_cmd_output() removes its reserved temporary
          file before the shell opens it, allowing another Vim process to
          reuse the same name.
Solution: Keep the temporary file reserved until command output handling is
          complete (Sam Roeca).

closes: #20915

Signed-off-by: Sam Roeca <samuel.roeca@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/misc1.c b/src/misc1.c
index 6ba215500d1ffd1769c68998a2b3889fb8a4ef0f..5927768a25a64bb9929dc02293843722eed56680 100644 (file)
--- a/src/misc1.c
+++ b/src/misc1.c
@@ -2430,8 +2430,9 @@ get_cmd_output(
     if (check_restricted() || check_secure())
        return NULL;
 
-    // get a name for the temp file
-    if ((tempname = vim_tempname('o', FALSE)) == NULL)
+    // Keep the file reserved until the shell opens it.  On MS-Windows,
+    // deleting it here would let another Vim process reuse the same name.
+    if ((tempname = vim_tempname('o', TRUE)) == NULL)
     {
        emsg(_(e_cant_get_temp_file_name));
        return NULL;
@@ -2478,7 +2479,6 @@ get_cmd_output(
     if (buffer != NULL)
        i = (int)fread((char *)buffer, (size_t)1, (size_t)len, fd);
     fclose(fd);
-    mch_remove(tempname);
     if (buffer == NULL)
        goto done;
 # ifdef VMS
@@ -2502,6 +2502,7 @@ get_cmd_output(
        *ret_len = len;
 
 done:
+    mch_remove(tempname);
     vim_free(tempname);
     return buffer;
 }
@@ -2955,4 +2956,3 @@ trim_to_int(vimlong_T x)
 {
     return x > INT_MAX ? INT_MAX : x < INT_MIN ? INT_MIN : x;
 }
-

diff --git a/src/version.c b/src/version.c
index fedd56dba8677440319b0f5b7062ed1ff5f69c92..41209b1257b035623c14ff7764b4734e0e048b15 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -763,6 +763,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    899,
 /**/
     898,
 /**/