diff options
| author | Bram Moolenaar <Bram@vim.org> | 2020-11-06 13:44:21 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2020-11-06 13:44:21 +0100 |
| commit | 32e5ec0b017adb68fe36adb9a9a362abdaffe7f4 (patch) | |
| tree | e4e280ed8662b25eb2361c711d05cc2e750bafce /src/netbeans.c | |
| parent | 85d9b03f84f59c4c6013d6bd7e6d1bb8091ee8c5 (diff) | |
| download | vim-git-32e5ec0b017adb68fe36adb9a9a362abdaffe7f4.tar.gz | |
patch 8.2.1962: netbeans may access freed memoryv8.2.1962
Problem: Netbeans may access freed memory.
Solution: Check the buffer pointer is still valid. Add a test. (Yegappan
Lakshmanan, closes #7248)
Diffstat (limited to 'src/netbeans.c')
| -rw-r--r-- | src/netbeans.c | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/src/netbeans.c b/src/netbeans.c index ccff3a536..1a565df00 100644 --- a/src/netbeans.c +++ b/src/netbeans.c @@ -572,7 +572,7 @@ nb_free(void) buf = buf_list[i]; vim_free(buf.displayname); vim_free(buf.signmap); - if (buf.bufp != NULL) + if (buf.bufp != NULL && buf_valid(buf.bufp)) { buf.bufp->b_netbeans_file = FALSE; buf.bufp->b_was_netbeans_file = FALSE; @@ -1943,15 +1943,13 @@ nb_do_cmd( if (STRLEN(fg) > MAX_COLOR_LENGTH || STRLEN(bg) > MAX_COLOR_LENGTH) { emsg("E532: highlighting color name too long in defineAnnoType"); - vim_free(typeName); + VIM_CLEAR(typeName); parse_error = TRUE; } else if (typeName != NULL && tooltip != NULL && glyphFile != NULL) addsigntype(buf, typeNum, typeName, tooltip, glyphFile, fg, bg); - else - vim_free(typeName); - // don't free typeName; it's used directly in addsigntype() + vim_free(typeName); vim_free(fg); vim_free(bg); vim_free(tooltip); @@ -3240,7 +3238,7 @@ addsigntype( } } - globalsignmap[i] = (char *)typeName; + globalsignmap[i] = (char *)vim_strsave(typeName); globalsignmapused = i + 1; } |