Mercurial > vim

changeset 21087:e01b20e3a720 v8.2.1095

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
patch 8.2.1095: may use pointer after freeing it Commit: https://github.com/vim/vim/commit/6b949615edac2dd33d5e865be8328561f296b045 Author: Bram Moolenaar <Bram@vim.org> Date: Mon Jun 29 23:18:42 2020 +0200 patch 8.2.1095: may use pointer after freeing it Problem: May use pointer after freeing it when text properties are used. Solution: Update redo buffer before calling ml_replace().
author Bram Moolenaar <Bram@vim.org>
date Mon, 29 Jun 2020 23:30:04 +0200
parents 6e6dc7d7b040
children 949a9ea0cfce
files src/spellsuggest.c src/version.c
diffstat 2 files changed, 6 insertions(+), 3 deletions(-) [+]
line wrap: on
line diff
--- a/src/spellsuggest.c
+++ b/src/spellsuggest.c
@@ -676,8 +676,6 @@ spell_suggest(int count)
 	    mch_memmove(p, line, c);
 	    STRCPY(p + c, stp->st_word);
 	    STRCAT(p, sug.su_badptr + stp->st_orglen);
-	    ml_replace(curwin->w_cursor.lnum, p, FALSE);
-	    curwin->w_cursor.col = c;
 
 	    // For redo we use a change-word command.
 	    ResetRedobuff();
@@ -686,7 +684,10 @@ spell_suggest(int count)
 			    stp->st_wordlen + sug.su_badlen - stp->st_orglen);
 	    AppendCharToRedobuff(ESC);
 
-	    // After this "p" may be invalid.
+	    // "p" may be freed here
+	    ml_replace(curwin->w_cursor.lnum, p, FALSE);
+	    curwin->w_cursor.col = c;
+
 	    changed_bytes(curwin->w_cursor.lnum, c);
 	}
     }
--- a/src/version.c
+++ b/src/version.c
@@ -755,6 +755,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1095,
+/**/
     1094,
 /**/
     1093,