# HG changeset patch # User Bram Moolenaar # Date 1569677403 -7200 # Node ID f31b0ac6e1754fb466fd4d6bf734c22e6e0f533b # Parent f881dda47df24da58d0309587e4bcd72a7bcd281 patch 8.1.2091: double free when memory allocation fails Commit: https://github.com/vim/vim/commit/0f1c6708fdf17bb9c7305b8af5d12189956195b6 Author: Bram Moolenaar Date: Sat Sep 28 15:24:00 2019 +0200 patch 8.1.2091: double free when memory allocation fails Problem: Double free when memory allocation fails. (Zu-Ming Jiang) Solution: Use VIM_CLEAR() instead of vim_free(). (closes https://github.com/vim/vim/issues/4991) diff --git a/src/getchar.c b/src/getchar.c --- a/src/getchar.c +++ b/src/getchar.c @@ -1296,11 +1296,11 @@ free_typebuf(void) if (typebuf.tb_buf == typebuf_init) internal_error("Free typebuf 1"); else - vim_free(typebuf.tb_buf); + VIM_CLEAR(typebuf.tb_buf); if (typebuf.tb_noremap == noremapbuf_init) internal_error("Free typebuf 2"); else - vim_free(typebuf.tb_noremap); + VIM_CLEAR(typebuf.tb_noremap); } /* diff --git a/src/version.c b/src/version.c --- a/src/version.c +++ b/src/version.c @@ -758,6 +758,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 2091, +/**/ 2090, /**/ 2089,