summaryrefslogtreecommitdiff
path: root/src/eval.c
diff options
context:
space:
mode:
authorBram Moolenaar <Bram@vim.org>2016-11-14 21:50:00 +0100
committerBram Moolenaar <Bram@vim.org>2016-11-14 21:50:00 +0100
commit8a01f969c198eeb655ad2f96f2796a6f6f4a1924 (patch)
tree3d71f55b5f569b7468dc82c026d0f808021b889d /src/eval.c
parent7618e00d3b8bfe064cfc524640d754607361f9df (diff)
downloadvim-git-8a01f969c198eeb655ad2f96f2796a6f6f4a1924.tar.gz
patch 8.0.0085v8.0.0085
Problem: Using freed memory with recursive function call. (Dominique Pelle) Solution: Make a copy of the function name.
Diffstat (limited to 'src/eval.c')
-rw-r--r--src/eval.c15
1 files changed, 11 insertions, 4 deletions
diff --git a/src/eval.c b/src/eval.c
index e92a97f18..7ca129b37 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -4339,10 +4339,17 @@ eval7(
* use its contents. */
s = deref_func_name(s, &len, &partial, !evaluate);
- /* Invoke the function. */
- ret = get_func_tv(s, len, rettv, arg,
- curwin->w_cursor.lnum, curwin->w_cursor.lnum,
- &len, evaluate, partial, NULL);
+ /* Need to make a copy, in case evaluating the arguments makes
+ * the name invalid. */
+ s = vim_strsave(s);
+ if (s == NULL)
+ ret = FAIL;
+ else
+ /* Invoke the function. */
+ ret = get_func_tv(s, len, rettv, arg,
+ curwin->w_cursor.lnum, curwin->w_cursor.lnum,
+ &len, evaluate, partial, NULL);
+ vim_free(s);
/* If evaluate is FALSE rettv->v_type was not set in
* get_func_tv, but it's needed in handle_subscript() to parse