thac0/vim
1
0
Fork 0
forked from aniani/vim
Code Activity

patch 9.0.1093: using freed memory of object member

Browse Source 
Problem:    Using freed memory of object member. (Yegappan Lakshmanan)
Solution:   Make a copy of the object member when getting it.
This commit is contained in:
Bram Moolenaar
2022-12-24 21:24:06 +00:00
parent e86190e7c1
commit 590162cae0
3 changed files with 30 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/vim9execute.c
View File

@@ -3799,7 +3799,7 @@ exec_instructions(ectx_T *ectx)
tv->vval.v_number = iptr->isn_arg.storenr.stnr_val;
break;
// store value in list or dict variable
// Store a value in a list, dict, blob or object variable.
case ISN_STOREINDEX:
{
int res = execute_storeindex(iptr, ectx);
@@ -5159,7 +5159,7 @@ exec_instructions(ectx_T *ectx)
object_T *obj = tv->vval.v_object;
// the members are located right after the object struct
typval_T *mtv = ((typval_T *)(obj + 1)) + idx;
*tv = *mtv;
copy_tv(mtv, tv);
// Unreference the object after getting the member, it may
// be freed.