patch 9.0.1988: Vim9: potential use-after-free for class members Commit: https://github.com/vim/vim/commit/d2f4800099733216e28d59e1a5710f624b0d9ec1 Author: Yegappan Lakshmanan <yegappan@yahoo.com> Date: Thu Oct 5 20:24:18 2023 +0200 patch 9.0.1988: Vim9: potential use-after-free for class members Problem: Vim9: potential use-after-free for class members Solution: Use the class-related grow array for storing the member type instead of using a temporary type list grow array Use the type list grow array associated with the class than using a temporary type list grow array to allocate the class member type. For simple types, a predefined type is used. For complex types, the type is dynamically allocated from a grow array. For class variables, the type grow array in the class should be used. So that the lifetime of the type is same as the lifetime of the class. closes: #13279 Signed-off-by: Christian Brabandt <cb@256bit.org> Co-authored-by: Yegappan Lakshmanan <yegappan@yahoo.com>

// if_ole.idl - IDL source for the Vim OLE Automation interface
//
// Processed by the IDL compiler (MIDL) to generate the type library
// (Vim.tlb).
//
// Command line:
//   MIDL /proxy nul /iid iid_ole.c /h if_ole.h /tlb vim.tlb if_ole.idl

[
	object,
	uuid(0F0BFAE2-4C90-11d1-82D7-0004AC368519),  // IID_IVim
	helpstring("IVim"),
	pointer_default(unique),
	dual,
	oleautomation
]
interface IVim : IDispatch
{
	import "oaidl.idl";
	HRESULT SendKeys([in]BSTR keys);
	HRESULT Eval([in]BSTR expr, [out, retval]BSTR* result);
	HRESULT SetForeground(void);
	HRESULT GetHwnd([out, retval]UINT_PTR* result);
};

// Component and type library definitions
[
	uuid(0F0BFAE0-4C90-11d1-82D7-0004AC368519),		// LIBID_Vim
	helpstring("Vim OLE Interface 1.1 Type Library"),
	version(1.1)
]
library Vim
{
	importlib("stdole32.tlb");

	// Component
	[
		uuid(0F0BFAE1-4C90-11d1-82D7-0004AC368519),  // CLSID_Vim
		helpstring("Vim OLE Interface")
	]
	coclass Vim
	{
		[default] interface IVim;
	};
};