diff options
| author | Bram Moolenaar <Bram@vim.org> | 2022-12-24 21:24:06 +0000 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2022-12-24 21:24:06 +0000 |
| commit | 590162cae0410b50572a3ab0e72a2e5873b99f1a (patch) | |
| tree | 4ecaf10f2f0c9b56c990574e8c32e8f4a8918918 /src/vim9execute.c | |
| parent | e86190e7c1297da29d0fc2415fdeca5ecae8d2ba (diff) | |
| download | vim-git-9.0.1093.tar.gz | |
patch 9.0.1093: using freed memory of object memberv9.0.1093
Problem: Using freed memory of object member. (Yegappan Lakshmanan)
Solution: Make a copy of the object member when getting it.
Diffstat (limited to 'src/vim9execute.c')
| -rw-r--r-- | src/vim9execute.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/vim9execute.c b/src/vim9execute.c index cdaeb5b84..a6d43b5c1 100644 --- a/src/vim9execute.c +++ b/src/vim9execute.c @@ -3799,7 +3799,7 @@ exec_instructions(ectx_T *ectx) tv->vval.v_number = iptr->isn_arg.storenr.stnr_val; break; - // store value in list or dict variable + // Store a value in a list, dict, blob or object variable. case ISN_STOREINDEX: { int res = execute_storeindex(iptr, ectx); @@ -5159,7 +5159,7 @@ exec_instructions(ectx_T *ectx) object_T *obj = tv->vval.v_object; // the members are located right after the object struct typval_T *mtv = ((typval_T *)(obj + 1)) + idx; - *tv = *mtv; + copy_tv(mtv, tv); // Unreference the object after getting the member, it may // be freed. |