From 958f39cb956fda0d3154e28f61d1764b5d9ccd10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Helleu?= <flashcode@flashtux.org>
Date: Tue, 3 Jan 2023 17:02:38 +0100
Subject: [PATCH] core: fix crash or infinite loop in /allbuf command

A crash could occur if the command closes buffers.
An infinite loop could occur if the command creates new buffers.
---
 src/core/wee-command.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/src/core/wee-command.c b/src/core/wee-command.c
index 24e997796..4be1b6a16 100644
--- a/src/core/wee-command.c
+++ b/src/core/wee-command.c
@@ -94,7 +94,9 @@ extern char **environ;
 
 COMMAND_CALLBACK(allbuf)
 {
+    struct t_arraylist *all_buffers;
     struct t_gui_buffer *ptr_buffer;
+    int i, list_size;
 
     /* make C compiler happy */
     (void) pointer;
@@ -103,12 +105,26 @@ COMMAND_CALLBACK(allbuf)
 
     COMMAND_MIN_ARGS(2, "");
 
+    all_buffers = arraylist_new (gui_buffers_count, 0, 0,
+                                 NULL, NULL, NULL, NULL);
+
     for (ptr_buffer = gui_buffers; ptr_buffer;
          ptr_buffer = ptr_buffer->next_buffer)
     {
+        arraylist_add (all_buffers, ptr_buffer);
+    }
+
+    list_size = arraylist_size (all_buffers);
+    for (i = 0; i < list_size; i++)
+    {
+        ptr_buffer = (struct t_gui_buffer *)arraylist_get (all_buffers, i);
+        if (!gui_buffer_valid (ptr_buffer))
+            continue;
         (void) input_data (ptr_buffer, argv_eol[1], NULL);
     }
 
+    arraylist_free (all_buffers);
+
     return WEECHAT_RC_OK;
 }