From: Sam Roeca <samuel.roeca@gmail.com>
Date: Sun, 2 Aug 2026 18:41:16 +0000 (+0000)
Subject: patch 9.2.0899: command output temporary files may collide
X-Git-Tag: v9.2.0899^0
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0db0c3c142b9994b64c63162914ba4db528f88a2;p=thirdparty%2Fvim.git

patch 9.2.0899: command output temporary files may collide

Problem:  On MS-Windows, get_cmd_output() removes its reserved temporary
          file before the shell opens it, allowing another Vim process to
          reuse the same name.
Solution: Keep the temporary file reserved until command output handling is
          complete (Sam Roeca).

closes: #20915

Signed-off-by: Sam Roeca <samuel.roeca@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/misc1.c b/src/misc1.c
index 6ba215500d..5927768a25 100644
--- a/src/misc1.c
+++ b/src/misc1.c
@@ -2430,8 +2430,9 @@ get_cmd_output(
     if (check_restricted() || check_secure())
 	return NULL;
 
-    // get a name for the temp file
-    if ((tempname = vim_tempname('o', FALSE)) == NULL)
+    // Keep the file reserved until the shell opens it.  On MS-Windows,
+    // deleting it here would let another Vim process reuse the same name.
+    if ((tempname = vim_tempname('o', TRUE)) == NULL)
     {
 	emsg(_(e_cant_get_temp_file_name));
 	return NULL;
@@ -2478,7 +2479,6 @@ get_cmd_output(
     if (buffer != NULL)
 	i = (int)fread((char *)buffer, (size_t)1, (size_t)len, fd);
     fclose(fd);
-    mch_remove(tempname);
     if (buffer == NULL)
 	goto done;
 # ifdef VMS
@@ -2502,6 +2502,7 @@ get_cmd_output(
 	*ret_len = len;
 
 done:
+    mch_remove(tempname);
     vim_free(tempname);
     return buffer;
 }
@@ -2955,4 +2956,3 @@ trim_to_int(vimlong_T x)
 {
     return x > INT_MAX ? INT_MAX : x < INT_MIN ? INT_MIN : x;
 }
-
diff --git a/src/version.c b/src/version.c
index fedd56dba8..41209b1257 100644
--- a/src/version.c
+++ b/src/version.c
@@ -763,6 +763,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    899,
 /**/
     898,
 /**/