diff options
| author | Bram Moolenaar <Bram@vim.org> | 2019-09-28 15:24:00 +0200 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2019-09-28 15:24:00 +0200 |
| commit | 0f1c6708fdf17bb9c7305b8af5d12189956195b6 (patch) | |
| tree | 1dd2dcec1013f8b500a1bbf030e5f83b3b24c560 | |
| parent | 2e47cab715669bd0c89762217cbf77bd70cd82ac (diff) | |
| download | vim-git-0f1c6708fdf17bb9c7305b8af5d12189956195b6.tar.gz | |
patch 8.1.2091: double free when memory allocation failsv8.1.2091
Problem: Double free when memory allocation fails. (Zu-Ming Jiang)
Solution: Use VIM_CLEAR() instead of vim_free(). (closes #4991)
| -rw-r--r-- | src/getchar.c | 4 | ||||
| -rw-r--r-- | src/version.c | 2 |
2 files changed, 4 insertions, 2 deletions
diff --git a/src/getchar.c b/src/getchar.c index 1056e938e..fcdc63968 100644 --- a/src/getchar.c +++ b/src/getchar.c @@ -1296,11 +1296,11 @@ free_typebuf(void) if (typebuf.tb_buf == typebuf_init) internal_error("Free typebuf 1"); else - vim_free(typebuf.tb_buf); + VIM_CLEAR(typebuf.tb_buf); if (typebuf.tb_noremap == noremapbuf_init) internal_error("Free typebuf 2"); else - vim_free(typebuf.tb_noremap); + VIM_CLEAR(typebuf.tb_noremap); } /* diff --git a/src/version.c b/src/version.c index e595c7ab6..2d9ffa357 100644 --- a/src/version.c +++ b/src/version.c @@ -758,6 +758,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 2091, +/**/ 2090, /**/ 2089, |