Mercurial > vim

diff src/list.c @ 25784:8dfcee931c6c v8.2.3427

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
patch 8.2.3427: double free when list is copied Commit: https://github.com/vim/vim/commit/b3bf33a7b227df871834e816c4ce4b2706b56bea Author: Bram Moolenaar <Bram@vim.org> Date: Sat Sep 11 20:20:38 2021 +0200 patch 8.2.3427: double free when list is copied Problem: Double free when list is copied. Solution: Allocate the type when making a copy. (closes https://github.com/vim/vim/issues/8862) Clear the type for flattennew(). Avoid a memory leak when flattennew() fails.
author Bram Moolenaar <Bram@vim.org>
date Sat, 11 Sep 2021 20:30:04 +0200
parents 9edad9a8cca6
children 14954a7e7c6d
line wrap: on
line diff
--- a/src/list.c
+++ b/src/list.c
@@ -952,7 +952,10 @@ list_flatten(list_T *list, long maxdepth
 
 	    vimlist_remove(list, item, item);
 	    if (list_extend(list, item->li_tv.vval.v_list, next) == FAIL)
+	    {
+		list_free_item(list, item);
 		return;
+	    }
 	    clear_tv(&item->li_tv);
 	    tofree = item;
 
@@ -1023,6 +1026,9 @@ flatten_common(typval_T *argvars, typval
 	rettv->vval.v_list = l;
 	if (l == NULL)
 	    return;
+	// The type will change.
+	free_type(l->lv_type);
+	l->lv_type = NULL;
     }
     else
     {
@@ -1217,7 +1223,7 @@ list_copy(list_T *orig, int deep, int co
     copy = list_alloc();
     if (copy != NULL)
     {
-	copy->lv_type = orig->lv_type;
+	copy->lv_type = alloc_type(orig->lv_type);
 	if (copyID != 0)
 	{
 	    // Do this before adding the items, because one of the items may