patch 9.0.2117: [security] use-after-free in qf_free_items Commit: https://github.com/vim/vim/commit/567cae2630a51efddc07eacff3b38a295e1f5671 Author: Christian Brabandt <cb@256bit.org> Date: Sun Nov 19 16:19:27 2023 +0100 patch 9.0.2117: [security] use-after-free in qf_free_items Problem: [security] use-after-free in qf_free_items Solution: only access qfpnext, if it hasn't been freed Coverity discovered a possible use-after-free in qf_free_items. When freeing the qfline items, we may access freed memory, when qfp == qfpnext. So only access qfpnext, when it hasn't been freed. Signed-off-by: Christian Brabandt <cb@256bit.org>

--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -4000,8 +4000,9 @@ qf_free_items(qf_list_T *qfl)
 		// to avoid crashing when it's wrong.
 		// TODO: Avoid qf_count being incorrect.
 		qfl->qf_count = 1;
+	    else
+		qfl->qf_start = qfpnext;
 	}
-	qfl->qf_start = qfpnext;
 	--qfl->qf_count;
     }