Mercurial > vim
comparison src/register.c @ 29647:d564107db756 v9.0.0164
patch 9.0.0164: using freed memory with put command
Commit: https://github.com/vim/vim/commit/c390cc13e55b25d85a0684aa1becde881ef8ab19
Author: Bram Moolenaar <Bram@vim.org>
Date: Sun Aug 7 18:09:10 2022 +0100
patch 9.0.0164: using freed memory with put command
Problem: Using freed memory with put command.
Solution: Get byte offset before replacing the line.
| author | Bram Moolenaar <Bram@vim.org> |
|---|---|
| date | Sun, 07 Aug 2022 19:15:02 +0200 |
| parents | 9cd050914eb6 |
| children | 89e1d67814a9 |
comparison
equal
deleted
inserted
replaced
| 29646:27333a2163d4 | 29647:d564107db756 |
|---|---|
| 2097 { | 2097 { |
| 2098 mch_memmove(ptr, y_array[0], (size_t)yanklen); | 2098 mch_memmove(ptr, y_array[0], (size_t)yanklen); |
| 2099 ptr += yanklen; | 2099 ptr += yanklen; |
| 2100 } | 2100 } |
| 2101 STRMOVE(ptr, oldp + col); | 2101 STRMOVE(ptr, oldp + col); |
| 2102 ml_replace(lnum, newp, FALSE); | |
| 2103 | |
| 2104 inserted_bytes(lnum, col, totlen); | |
| 2105 | 2102 |
| 2106 // compute the byte offset for the last character | 2103 // compute the byte offset for the last character |
| 2107 first_byte_off = mb_head_off(newp, ptr - 1); | 2104 first_byte_off = mb_head_off(newp, ptr - 1); |
| 2105 | |
| 2106 // Note: this may free "newp" | |
| 2107 ml_replace(lnum, newp, FALSE); | |
| 2108 | |
| 2109 inserted_bytes(lnum, col, totlen); | |
| 2108 | 2110 |
| 2109 // Place cursor on last putted char. | 2111 // Place cursor on last putted char. |
| 2110 if (lnum == curwin->w_cursor.lnum) | 2112 if (lnum == curwin->w_cursor.lnum) |
| 2111 { | 2113 { |
| 2112 // make sure curwin->w_virtcol is updated | 2114 // make sure curwin->w_virtcol is updated |