Commit: patch 9.2.0899: command output temporary files may collide

[Christian Brabandt]

patch 9.2.0899: command output temporary files may collide

Commit: https://github.com/vim/vim/commit/0db0c3c142b9994b64c63162914ba4db528f88a2
Author: Sam Roeca <samuel...@gmail.com>
Date: Sun Aug 2 18:41:16 2026 +0000

patch 9.2.0899: command output temporary files may collide

Problem: On MS-Windows, get_cmd_output() removes its reserved temporary
file before the shell opens it, allowing another Vim process to
reuse the same name.
Solution: Keep the temporary file reserved until command output handling is
complete (Sam Roeca).

closes: #20915

Signed-off-by: Sam Roeca <samuel...@gmail.com>
Signed-off-by: Christian Brabandt <c...@256bit.org>

diff --git a/src/misc1.c b/src/misc1.c
index 6ba215500..5927768a2 100644
--- a/src/misc1.c
+++ b/src/misc1.c
@@ -2430,8 +2430,9 @@ get_cmd_output(
if (check_restricted() || check_secure())
return NULL;

- // get a name for the temp file
- if ((tempname = vim_tempname('o', FALSE)) == NULL)
+ // Keep the file reserved until the shell opens it. On MS-Windows,
+ // deleting it here would let another Vim process reuse the same name.
+ if ((tempname = vim_tempname('o', TRUE)) == NULL)
{
emsg(_(e_cant_get_temp_file_name));
return NULL;
@@ -2478,7 +2479,6 @@ get_cmd_output(
if (buffer != NULL)
i = (int)fread((char *)buffer, (size_t)1, (size_t)len, fd);
fclose(fd);
- mch_remove(tempname);
if (buffer == NULL)
goto done;
# ifdef VMS
@@ -2502,6 +2502,7 @@ get_cmd_output(
*ret_len = len;

done:
+ mch_remove(tempname);
vim_free(tempname);
return buffer;
}
@@ -2955,4 +2956,3 @@ trim_to_int(vimlong_T x)
{
return x > INT_MAX ? INT_MAX : x < INT_MIN ? INT_MIN : x;
}
-
diff --git a/src/version.c b/src/version.c
index fedd56dba..41209b125 100644
--- a/src/version.c
+++ b/src/version.c
@@ -763,6 +763,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 899,
/**/
898,
/**/