diff options
| author | Bram Moolenaar <Bram@vim.org> | 2020-05-25 23:29:28 +0200 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2020-05-25 23:29:28 +0200 |
| commit | a14e6975478adeddcc2161edc1ec611016aa89f3 (patch) | |
| tree | 91d67e43f4bc17c7787d26b18e0f3b835a6cd703 | |
| parent | 1919371b2b9ddb1a645f40b59adbd89317530882 (diff) | |
| download | vim-git-8.2.0825.tar.gz | |
patch 8.2.0825: def_function() may return pointer that was freedv8.2.0825
Problem: def_function() may return pointer that was freed.
Solution: Set "fp" to NULL after freeing it.
| -rw-r--r-- | src/userfunc.c | 3 | ||||
| -rw-r--r-- | src/version.c | 2 |
2 files changed, 5 insertions, 0 deletions
diff --git a/src/userfunc.c b/src/userfunc.c index 87e06c61d..c50a871c2 100644 --- a/src/userfunc.c +++ b/src/userfunc.c @@ -3140,12 +3140,14 @@ def_function(exarg_T *eap, char_u *name_arg) if (fudi.fd_di == NULL) { vim_free(fp); + fp = NULL; goto erret; } if (dict_add(fudi.fd_dict, fudi.fd_di) == FAIL) { vim_free(fudi.fd_di); vim_free(fp); + fp = NULL; goto erret; } } @@ -3169,6 +3171,7 @@ def_function(exarg_T *eap, char_u *name_arg) else if (hash_add(&func_hashtab, UF2HIKEY(fp)) == FAIL) { vim_free(fp); + fp = NULL; goto erret; } fp->uf_refcount = 1; diff --git a/src/version.c b/src/version.c index ce5f627ca..5ccbfad01 100644 --- a/src/version.c +++ b/src/version.c @@ -747,6 +747,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 825, +/**/ 824, /**/ 823, |