aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-07-26 11:04:33 -04:00
Code

Fix: :redir to a dictionary that is changed before ":redir END" causes a

Browse Source 
memory access error.
This commit is contained in:
Bram Moolenaar 2010-07-28 18:55:02 +02:00
parent 477db060eb
commit 1dba0fbb7a
1 changed files with 9 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/eval.c
View File

@ -1056,6 +1056,7 @@ var_redir_start(name, append)
FNE_CHECK_START); FNE_CHECK_START);
if (redir_endp == NULL || redir_lval->ll_name == NULL || *redir_endp != NUL) if (redir_endp == NULL || redir_lval->ll_name == NULL || *redir_endp != NUL)
{ {
clear_lval(redir_lval);
if (redir_endp != NULL && *redir_endp != NUL) if (redir_endp != NULL && *redir_endp != NUL)
/* Trailing characters are present after the variable name */ /* Trailing characters are present after the variable name */
EMSG(_(e_trailing)); EMSG(_(e_trailing));
@ -1076,6 +1077,7 @@ var_redir_start(name, append)
set_var_lval(redir_lval, redir_endp, &tv, TRUE, (char_u *)"."); set_var_lval(redir_lval, redir_endp, &tv, TRUE, (char_u *)".");
else else
set_var_lval(redir_lval, redir_endp, &tv, TRUE, (char_u *)"="); set_var_lval(redir_lval, redir_endp, &tv, TRUE, (char_u *)"=");
clear_lval(redir_lval);
err = did_emsg; err = did_emsg;
did_emsg |= save_emsg; did_emsg |= save_emsg;
if (err) if (err)
@ -1084,12 +1086,6 @@ var_redir_start(name, append)
var_redir_stop(); var_redir_stop();
return FAIL; return FAIL;
} }
if (redir_lval->ll_newkey != NULL)
{
/* Dictionary item was created, don't do it again. */
vim_free(redir_lval->ll_newkey);
redir_lval->ll_newkey = NULL;
}
return OK; return OK;
} }
@ -1144,14 +1140,19 @@ var_redir_stop()
ga_append(&redir_ga, NUL); /* Append the trailing NUL. */ ga_append(&redir_ga, NUL); /* Append the trailing NUL. */
tv.v_type = VAR_STRING; tv.v_type = VAR_STRING;
tv.vval.v_string = redir_ga.ga_data; tv.vval.v_string = redir_ga.ga_data;
/* Call get_lval() again, if it's inside a Dict or List it may
* have changed. */
redir_endp = get_lval(redir_varname, NULL, redir_lval,
FALSE, FALSE, FALSE, FNE_CHECK_START);
if (redir_endp != NULL && redir_lval->ll_name != NULL)
set_var_lval(redir_lval, redir_endp, &tv, FALSE, (char_u *)"."); set_var_lval(redir_lval, redir_endp, &tv, FALSE, (char_u *)".");
clear_lval(redir_lval);
} }
/* free the collected output */ /* free the collected output */
vim_free(redir_ga.ga_data); vim_free(redir_ga.ga_data);
redir_ga.ga_data = NULL; redir_ga.ga_data = NULL;
clear_lval(redir_lval);
vim_free(redir_lval); vim_free(redir_lval);
redir_lval = NULL; redir_lval = NULL;
} }