aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-25 03:54:15 -04:00
Code Activity

patch 9.0.0225: using freed memory with multiple line breaks in expression

Browse Source 
Problem:    Using freed memory with multiple line breaks in expression.
Solution:   Free eval_tofree later.
This commit is contained in:
Bram Moolenaar
2022-08-18 13:28:31 +01:00
parent 4875d6ab06
commit 91c7cbfe31
5 changed files with 77 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/userfunc.c
View File

@@ -1372,7 +1372,6 @@ get_lambda_tv(
char_u *start, *end;
int *old_eval_lavars = eval_lavars_used;
int eval_lavars = FALSE;
char_u *tofree1 = NULL;
char_u *tofree2 = NULL;
int equal_arrow = **arg == '(';
int white_error = FALSE;
@@ -1457,12 +1456,6 @@ get_lambda_tv(
ret = skip_expr_concatenate(arg, &start, &end, evalarg);
if (ret == FAIL)
goto errret;
if (evalarg != NULL)
{
// avoid that the expression gets freed when another line break follows
tofree1 = evalarg->eval_tofree;
evalarg->eval_tofree = NULL;
}
if (!equal_arrow)
{
@@ -1585,10 +1578,6 @@ get_lambda_tv(
theend:
eval_lavars_used = old_eval_lavars;
if (evalarg != NULL && evalarg->eval_tofree == NULL)
evalarg->eval_tofree = tofree1;
else
vim_free(tofree1);
vim_free(tofree2);
if (types_optional)
ga_clear_strings(&argtypes);
@@ -1607,10 +1596,6 @@ errret:
}
vim_free(fp);
vim_free(pt);
if (evalarg != NULL && evalarg->eval_tofree == NULL)
evalarg->eval_tofree = tofree1;
else
vim_free(tofree1);
vim_free(tofree2);
eval_lavars_used = old_eval_lavars;
return FAIL;