Mercurial > vim
changeset 35130:732accc824dc v9.1.0395
patch 9.1.0395: getregionpos() may leak memory on error
Commit: https://github.com/vim/vim/commit/b8ecedce79149ac6b994177e9a68979f86065cb1
Author: Christian Brabandt <cb@256bit.org>
Date: Wed May 8 19:50:26 2024 +0200
patch 9.1.0395: getregionpos() may leak memory on error
Problem: regionpos may leak memory on error, coverity
complains about dereferencing Null pointer
Solution: free all list pointers (after v9.1.394),
return early if buflist_findnr() returns NULL
closes: #14731
Signed-off-by: Christian Brabandt <cb@256bit.org>
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Wed, 08 May 2024 20:00:03 +0200 |
| parents | be122dc08867 |
| children | d95c42df4444 |
| files | src/evalfunc.c src/version.c |
| diffstat | 2 files changed, 18 insertions(+), 3 deletions(-) [+] |
line wrap: on
line diff
--- a/src/evalfunc.c +++ b/src/evalfunc.c @@ -5727,6 +5727,10 @@ add_regionpos_range( buf_T *findbuf; int max_col1, max_col2; + findbuf = bufnr != 0 ? buflist_findnr(bufnr) : curbuf; + if (findbuf == NULL || findbuf->b_ml.ml_mfp == NULL) + return; + l1 = list_alloc(); if (l1 == NULL) return; @@ -5739,25 +5743,34 @@ add_regionpos_range( l2 = list_alloc(); if (l2 == NULL) - return; + { + vim_free(l1); + return; + } if (list_append_list(l1, l2) == FAIL) { + vim_free(l1); vim_free(l2); return; } l3 = list_alloc(); if (l3 == NULL) - return; + { + vim_free(l1); + vim_free(l2); + return; + } if (list_append_list(l1, l3) == FAIL) { + vim_free(l1); + vim_free(l2); vim_free(l3); return; } - findbuf = bufnr != 0 ? buflist_findnr(bufnr) : curbuf; max_col1 = ml_get_buf_len(findbuf, lnum1); list_append_number(l2, bufnr);