From d77f9d595eb5f301b39b4373f2900a13c0ca30e2 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Sun, 4 Sep 2016 15:13:39 +0200
Subject: patch 7.4.2323 Problem:    Using freed memory when using
 'formatexpr'. (Dominique Pelle) Solution:   Make a copy of 'formatexpr'
 before evaluating it.

---
 src/ops.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

(limited to 'src/ops.c')

diff --git a/src/ops.c b/src/ops.c
index c03c7be2e..4bef6c5a2 100644
--- a/src/ops.c
+++ b/src/ops.c
@@ -4741,6 +4741,7 @@ fex_format(
     int		use_sandbox = was_set_insecurely((char_u *)"formatexpr",
 								   OPT_LOCAL);
     int		r;
+    char_u	*fex;
 
     /*
      * Set v:lnum to the first line number and v:count to the number of lines.
@@ -4750,16 +4751,22 @@ fex_format(
     set_vim_var_nr(VV_COUNT, count);
     set_vim_var_char(c);
 
+    /* Make a copy, the option could be changed while calling it. */
+    fex = vim_strsave(curbuf->b_p_fex);
+    if (fex == NULL)
+	return 0;
+
     /*
      * Evaluate the function.
      */
     if (use_sandbox)
 	++sandbox;
-    r = (int)eval_to_number(curbuf->b_p_fex);
+    r = (int)eval_to_number(fex);
     if (use_sandbox)
 	--sandbox;
 
     set_vim_var_string(VV_CHAR, NULL, -1);
+    vim_free(fex);
 
     return r;
 }
-- 
cgit v1.2.1