Mercurial > vim

comparison src/userfunc.c @ 29771:c71a42be2d7f v9.0.0225

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
patch 9.0.0225: using freed memory with multiple line breaks in expression Commit: https://github.com/vim/vim/commit/91c7cbfe31bbef57d5fcf7d76989fc159f73ef15 Author: Bram Moolenaar <Bram@vim.org> Date: Thu Aug 18 13:28:31 2022 +0100 patch 9.0.0225: using freed memory with multiple line breaks in expression Problem: Using freed memory with multiple line breaks in expression. Solution: Free eval_tofree later.
author Bram Moolenaar <Bram@vim.org>
date Thu, 18 Aug 2022 14:30:05 +0200
parents d19adfd545e2
children cd573d7bc30d
comparison
equal deleted inserted replaced
29770:653c04c1dcf1 29771:c71a42be2d7f
1370 int ret; 1370 int ret;
1371 char_u *s; 1371 char_u *s;
1372 char_u *start, *end; 1372 char_u *start, *end;
1373 int *old_eval_lavars = eval_lavars_used; 1373 int *old_eval_lavars = eval_lavars_used;
1374 int eval_lavars = FALSE; 1374 int eval_lavars = FALSE;
1375 char_u *tofree1 = NULL;
1376 char_u *tofree2 = NULL; 1375 char_u *tofree2 = NULL;
1377 int equal_arrow = **arg == '('; 1376 int equal_arrow = **arg == '(';
1378 int white_error = FALSE; 1377 int white_error = FALSE;
1379 int called_emsg_start = called_emsg; 1378 int called_emsg_start = called_emsg;
1380 int vim9script = in_vim9script(); 1379 int vim9script = in_vim9script();
1455 // Get the start and the end of the expression. 1454 // Get the start and the end of the expression.
1456 start = *arg; 1455 start = *arg;
1457 ret = skip_expr_concatenate(arg, &start, &end, evalarg); 1456 ret = skip_expr_concatenate(arg, &start, &end, evalarg);
1458 if (ret == FAIL) 1457 if (ret == FAIL)
1459 goto errret; 1458 goto errret;
1460 if (evalarg != NULL)
1461 {
1462 // avoid that the expression gets freed when another line break follows
1463 tofree1 = evalarg->eval_tofree;
1464 evalarg->eval_tofree = NULL;
1465 }
1466 1459
1467 if (!equal_arrow) 1460 if (!equal_arrow)
1468 { 1461 {
1469 *arg = skipwhite_and_linebreak(*arg, evalarg); 1462 *arg = skipwhite_and_linebreak(*arg, evalarg);
1470 if (**arg != '}') 1463 if (**arg != '}')
1583 hash_add(&func_hashtab, UF2HIKEY(fp)); 1576 hash_add(&func_hashtab, UF2HIKEY(fp));
1584 } 1577 }
1585 1578
1586 theend: 1579 theend:
1587 eval_lavars_used = old_eval_lavars; 1580 eval_lavars_used = old_eval_lavars;
1588 if (evalarg != NULL && evalarg->eval_tofree == NULL)
1589 evalarg->eval_tofree = tofree1;
1590 else
1591 vim_free(tofree1);
1592 vim_free(tofree2); 1581 vim_free(tofree2);
1593 if (types_optional) 1582 if (types_optional)
1594 ga_clear_strings(&argtypes); 1583 ga_clear_strings(&argtypes);
1595 1584
1596 return OK; 1585 return OK;
1605 if (fp != NULL) 1594 if (fp != NULL)
1606 vim_free(fp->uf_arg_types); 1595 vim_free(fp->uf_arg_types);
1607 } 1596 }
1608 vim_free(fp); 1597 vim_free(fp);
1609 vim_free(pt); 1598 vim_free(pt);
1610 if (evalarg != NULL && evalarg->eval_tofree == NULL)
1611 evalarg->eval_tofree = tofree1;
1612 else
1613 vim_free(tofree1);
1614 vim_free(tofree2); 1599 vim_free(tofree2);
1615 eval_lavars_used = old_eval_lavars; 1600 eval_lavars_used = old_eval_lavars;
1616 return FAIL; 1601 return FAIL;
1617 } 1602 }
1618 1603