# HG changeset patch
# User Bram Moolenaar <Bram@vim.org>
# Date 1659892502 -7200
# Node ID d564107db756c188c9c304e1f288ffb510319d0f
# Parent  27333a2163d48e2e7c2f217e65fd7ec0d4be6c59
patch 9.0.0164: using freed memory with put command

Commit: https://github.com/vim/vim/commit/c390cc13e55b25d85a0684aa1becde881ef8ab19
Author: Bram Moolenaar <Bram@vim.org>
Date:   Sun Aug 7 18:09:10 2022 +0100

    patch 9.0.0164: using freed memory with put command

    Problem:    Using freed memory with put command.
    Solution:   Get byte offset before replacing the line.

diff --git a/src/register.c b/src/register.c
--- a/src/register.c
+++ b/src/register.c
@@ -2099,13 +2099,15 @@ do_put(
 			ptr += yanklen;
 		    }
 		    STRMOVE(ptr, oldp + col);
+
+		    // compute the byte offset for the last character
+		    first_byte_off = mb_head_off(newp, ptr - 1);
+
+		    // Note: this may free "newp"
 		    ml_replace(lnum, newp, FALSE);
 
 		    inserted_bytes(lnum, col, totlen);
 
-		    // compute the byte offset for the last character
-		    first_byte_off = mb_head_off(newp, ptr - 1);
-
 		    // Place cursor on last putted char.
 		    if (lnum == curwin->w_cursor.lnum)
 		    {
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -736,6 +736,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    164,
+/**/
     163,
 /**/
     162,