Mercurial > vim
changeset 10906:7fc1df5536c9 v8.0.0342
patch 8.0.0342: double free with EXITFREE and setting 'ttytype'
commit https://github.com/vim/vim/commit/673911457d6745b6b779eb769c2f41965592d12c
Author: Bram Moolenaar <Bram@vim.org>
Date: Sun Feb 19 21:07:04 2017 +0100
patch 8.0.0342: double free with EXITFREE and setting 'ttytype'
Problem: Double free when compiled with EXITFREE and setting 'ttytype'.
Solution: Avoid setting P_ALLOCED on 'ttytype'. (Dominique Pelle,
closes #1461)
| author | Christian Brabandt <cb@256bit.org> |
|---|---|
| date | Sun, 19 Feb 2017 21:15:04 +0100 |
| parents | c8a5987d092d |
| children | 7b96d04312c2 |
| files | src/option.c src/testdir/test_options.vim src/version.c |
| diffstat | 3 files changed, 28 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/src/option.c +++ b/src/option.c @@ -3775,7 +3775,7 @@ free_all_options(void) if (options[i].indir == PV_NONE) { /* global option: free value and default value. */ - if (options[i].flags & P_ALLOCED && options[i].var != NULL) + if ((options[i].flags & P_ALLOCED) && options[i].var != NULL) free_string_option(*(char_u **)options[i].var); if (options[i].flags & P_DEF_ALLOCED) free_string_option(options[i].def_val[VI_DEFAULT]); @@ -5929,8 +5929,14 @@ did_set_string_option( else if (set_termname(T_NAME) == FAIL) errmsg = (char_u *)N_("E522: Not found in termcap"); else + { /* Screen colors may have changed. */ redraw_later_clear(); + + /* Both 'term' and 'ttytype' point to T_NAME, only set the + * P_ALLOCED flag on 'term'. */ + opt_idx = findoption((char_u *)"term"); + } } /* 'backupcopy' */
--- a/src/testdir/test_options.vim +++ b/src/testdir/test_options.vim @@ -235,3 +235,22 @@ func Test_set_errors() call assert_fails("set showbreak=\x01", 'E595:') call assert_fails('set t_foo=', 'E846:') endfunc + +func Test_set_ttytype() + if !has('gui_running') && has('unix') + " Setting 'ttytype' used to cause a double-free when exiting vim and + " when vim is compiled with -DEXITFREE. + set ttytype=ansi + call assert_equal('ansi', &ttytype) + call assert_equal(&ttytype, &term) + set ttytype=xterm + call assert_equal('xterm', &ttytype) + call assert_equal(&ttytype, &term) + " FIXME: "set ttytype=" gives E522 instead of E529 + " in travis on some builds. Why? Commented out this test for now. + " call assert_fails('set ttytype=', 'E529:') + call assert_fails('set ttytype=xxx', 'E522:') + set ttytype& + call assert_equal(&ttytype, &term) + endif +endfunc