0
0
mirror of https://github.com/vim/vim.git synced 2025-07-26 11:04:33 -04:00

patch 8.2.3923: Vim9: double free with split argument list in nested function

Problem:    Vim9: double free if a nested function has a line break in the
            argument list.
Solution:   Set cmdlinep when freeing the previous line.
This commit is contained in:
Bram Moolenaar 2021-12-28 17:23:12 +00:00
parent 8bb3fe4d4d
commit 4bf1006cae
3 changed files with 23 additions and 1 deletions

View File

@ -1669,7 +1669,7 @@ def Test_error_in_nested_function()
assert_fails('FuncWithForwardCall()', 'E1096:', '', 1, 'FuncWithForwardCall')
enddef
def Test_nested_functin_with_nextcmd()
def Test_nested_function_with_nextcmd()
var lines =<< trim END
vim9script
# Define an outer function
@ -1689,6 +1689,24 @@ def Test_nested_functin_with_nextcmd()
CheckScriptFailure(lines, 'E476: Invalid command: AAAAA')
enddef
def Test_nested_function_with_args_split()
var lines =<< trim END
vim9script
def FirstFunction()
def SecondFunction(
)
# had a double free if the right parenthesis of the nested function is
# on the next line
enddef|BBBB
enddef
# Compile all functions
defcompile
END
# FIXME: this should fail on the BBBB
CheckScriptSuccess(lines)
enddef
def Test_return_type_wrong()
CheckScriptFailure([
'def Func(): number',

View File

@ -219,6 +219,8 @@ get_function_args(
if (theline == NULL)
break;
vim_free(*line_to_free);
if (*eap->cmdlinep == *line_to_free)
*eap->cmdlinep = theline;
*line_to_free = theline;
whitep = (char_u *)" ";
p = skipwhite(theline);

View File

@ -749,6 +749,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
3923,
/**/
3922,
/**/