patch 8.2.1825: Vim9: accessing freed memoryv8.2.1825

Problem:    Vim9: accessing freed memory.
Solution:   Clear sv_name when the variable is deleted.

1 files changed, 19 insertions, 13 deletions

diff --git a/src/ex_eval.c b/src/ex_eval.c
index 6a7087b68..d205cafc4 100644
--- a/src/ex_eval.c
+++ b/src/ex_eval.c
@@ -925,22 +925,28 @@ leave_block(cstack_T *cstack)
 
     if (in_vim9script())
     {
-	scriptitem_T *si = SCRIPT_ITEM(current_sctx.sc_sid);
+	scriptitem_T	*si = SCRIPT_ITEM(current_sctx.sc_sid);
+	hashtab_T	*ht = get_script_local_ht();
 
-	for (i = cstack->cs_script_var_len[cstack->cs_idx];
-					       i < si->sn_var_vals.ga_len; ++i)
+	if (ht != NULL)
 	{
-	    svar_T	*sv = ((svar_T *)si->sn_var_vals.ga_data) + i;
-	    hashtab_T	*ht = get_script_local_ht();
-	    hashitem_T	*hi;
-
-	    if (ht != NULL)
+	    for (i = cstack->cs_script_var_len[cstack->cs_idx];
+					       i < si->sn_var_vals.ga_len; ++i)
 	    {
-		// Remove a variable declared inside the block, if it still
-		// exists.
-		hi = hash_find(ht, sv->sv_name);
-		if (!HASHITEM_EMPTY(hi))
-		    delete_var(ht, hi);
+		svar_T	*sv = ((svar_T *)si->sn_var_vals.ga_data) + i;
+		hashitem_T	*hi;
+
+		if (sv->sv_name != NULL)
+		{
+		    // Remove a variable declared inside the block, if it still
+		    // exists.
+		    hi = hash_find(ht, sv->sv_name);
+		    if (!HASHITEM_EMPTY(hi))
+		    {
+			delete_var(ht, hi);
+			sv->sv_name = NULL;
+		    }
+		}
 	    }
 	}
     }