Mercurial > vim

comparison src/ops.c @ 10104:b2dbe79639a2 v7.4.2323

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
commit https://github.com/vim/vim/commit/d77f9d595eb5f301b39b4373f2900a13c0ca30e2 Author: Bram Moolenaar <Bram@vim.org> Date: Sun Sep 4 15:13:39 2016 +0200 patch 7.4.2323 Problem: Using freed memory when using 'formatexpr'. (Dominique Pelle) Solution: Make a copy of 'formatexpr' before evaluating it.
author Christian Brabandt <cb@256bit.org>
date Sun, 04 Sep 2016 15:15:06 +0200
parents 4aead6a9b7a9
children 99896ee0cac5
comparison
equal deleted inserted replaced
10103:b2c8f28c83df 10104:b2dbe79639a2
4739 int c) /* character to be inserted */ 4739 int c) /* character to be inserted */
4740 { 4740 {
4741 int use_sandbox = was_set_insecurely((char_u *)"formatexpr", 4741 int use_sandbox = was_set_insecurely((char_u *)"formatexpr",
4742 OPT_LOCAL); 4742 OPT_LOCAL);
4743 int r; 4743 int r;
4744 char_u *fex;
4744 4745
4745 /* 4746 /*
4746 * Set v:lnum to the first line number and v:count to the number of lines. 4747 * Set v:lnum to the first line number and v:count to the number of lines.
4747 * Set v:char to the character to be inserted (can be NUL). 4748 * Set v:char to the character to be inserted (can be NUL).
4748 */ 4749 */
4749 set_vim_var_nr(VV_LNUM, lnum); 4750 set_vim_var_nr(VV_LNUM, lnum);
4750 set_vim_var_nr(VV_COUNT, count); 4751 set_vim_var_nr(VV_COUNT, count);
4751 set_vim_var_char(c); 4752 set_vim_var_char(c);
4752 4753
4754 /* Make a copy, the option could be changed while calling it. */
4755 fex = vim_strsave(curbuf->b_p_fex);
4756 if (fex == NULL)
4757 return 0;
4758
4753 /* 4759 /*
4754 * Evaluate the function. 4760 * Evaluate the function.
4755 */ 4761 */
4756 if (use_sandbox) 4762 if (use_sandbox)
4757 ++sandbox; 4763 ++sandbox;
4758 r = (int)eval_to_number(curbuf->b_p_fex); 4764 r = (int)eval_to_number(fex);
4759 if (use_sandbox) 4765 if (use_sandbox)
4760 --sandbox; 4766 --sandbox;
4761 4767
4762 set_vim_var_string(VV_CHAR, NULL, -1); 4768 set_vim_var_string(VV_CHAR, NULL, -1);
4769 vim_free(fex);
4763 4770
4764 return r; 4771 return r;
4765 } 4772 }
4766 #endif 4773 #endif
4767 4774