From f1552d07d715b437d941659479942c2543b02bd4 Mon Sep 17 00:00:00 2001 From: Bram Moolenaar Date: Wed, 21 Aug 2019 12:54:18 +0200 Subject: patch 8.1.1897: may free memory twice when out of memory Problem: May free memory twice when out of memory. Solution: Check that backslash_halve_save() returns a different pointer. (Dominique Pelle, closes #4847) --- src/cmdexpand.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'src/cmdexpand.c') diff --git a/src/cmdexpand.c b/src/cmdexpand.c index 1454fd2f5..59d84419c 100644 --- a/src/cmdexpand.c +++ b/src/cmdexpand.c @@ -646,17 +646,19 @@ showmatches(expand_T *xp, int wildmenu UNUSED) { char_u *halved_slash; char_u *exp_path; + char_u *path; // Expansion was done before and special characters // were escaped, need to halve backslashes. Also // $HOME has been replaced with ~/. exp_path = expand_env_save_opt(files_found[k], TRUE); - halved_slash = backslash_halve_save( - exp_path != NULL ? exp_path : files_found[k]); + path = exp_path != NULL ? exp_path : files_found[k]; + halved_slash = backslash_halve_save(path); j = mch_isdir(halved_slash != NULL ? halved_slash : files_found[k]); vim_free(exp_path); - vim_free(halved_slash); + if (halved_slash != path) + vim_free(halved_slash); } else // Expansion was done here, file names are literal. -- cgit v1.2.1