Fix: segfault in tab completion (RHBZ#516024).

Actually this fixes two bugs: 'strs' was not being freed on every
path, and the tab completion segfault described in the bug report.

diff --git a/fish/destpaths.c b/fish/destpaths.c
index f4f1318..8b6173a 100644 (file)
--- a/fish/destpaths.c
+++ b/fish/destpaths.c
@@ -113,7 +113,7 @@ complete_dest_paths_generator (const char *text, int state)
       size_t i;                                                                \
       size_t n = count_strings (strs);                                 \
                                                                         \
-      if ( ! xalloc_oversized (nr_words + n, sizeof (struct word))) {  \
+      if ( n > 0 && ! xalloc_oversized (nr_words + n, sizeof (struct word))) { \
         struct word *w;                                                        \
         w = realloc (words, sizeof (struct word) * (nr_words + n));    \
                                                                         \
@@ -129,8 +129,8 @@ complete_dest_paths_generator (const char *text, int state)
             nr_words++;                                                        \
           }                                                            \
         }                                                              \
-        free (strs);                                                   \
       }                                                                        \
+      free (strs);                                                     \
     }                                                                  \
   } while (0)