diff options
| author | Bram Moolenaar <Bram@vim.org> | 2021-10-23 13:32:30 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2021-10-23 13:32:30 +0100 |
| commit | 844fb64a605d60131827503a001b2d1aa232b078 (patch) | |
| tree | 60451abfc3dac8be70ce364c4f8dd1d1164d298a /src/userfunc.c | |
| parent | ee56f3f119c4378a5b62b4d504cff3373b363308 (diff) | |
| download | vim-git-8.2.3560.tar.gz | |
patch 8.2.3560: using freed memory with lambdav8.2.3560
Problem: Using freed memory with lambda.
Solution: Do not free lines early, keep them until the expression is
finished.
Diffstat (limited to 'src/userfunc.c')
| -rw-r--r-- | src/userfunc.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/src/userfunc.c b/src/userfunc.c index 978487112..2f0637e7d 100644 --- a/src/userfunc.c +++ b/src/userfunc.c @@ -1177,12 +1177,17 @@ lambda_function_body( if (cmdline != NULL) { + garray_T *tfgap = &evalarg->eval_tofree_ga; + // Something comes after the "}". *arg = eap.nextcmd; // "arg" points into cmdline, need to keep the line and free it later. - vim_free(evalarg->eval_tofree_cmdline); - evalarg->eval_tofree_cmdline = cmdline; + if (ga_grow(tfgap, 1) == OK) + { + ((char_u **)(tfgap->ga_data))[tfgap->ga_len++] = cmdline; + evalarg->eval_using_cmdline = TRUE; + } } else *arg = (char_u *)""; @@ -4867,7 +4872,7 @@ ex_return(exarg_T *eap) return; } - CLEAR_FIELD(evalarg); + init_evalarg(&evalarg); evalarg.eval_flags = eap->skip ? 0 : EVAL_EVALUATE; if (eap->skip) |