aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-10-17 07:44:28 -04:00
Code Activity

patch 8.1.0917: double free when running out of memory

Browse Source 
Problem:    Double free when running out of memory.
Solution:   Remove one free. (Ken Takata, closes #3955)
This commit is contained in:
Bram Moolenaar
2019-02-14 13:43:36 +01:00
parent b999ba2778
commit 445e71c5ee
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/userfunc.c
View File

@@ -205,6 +205,7 @@ get_lambda_tv(char_u **arg, typval_T *rettv, int evaluate)
garray_T newlines;
garray_T *pnewargs;
ufunc_T *fp = NULL;
partial_T *pt = NULL;
int varargs;
int ret;
char_u *start = skipwhite(*arg + 1);
@@ -252,7 +253,6 @@ get_lambda_tv(char_u **arg, typval_T *rettv, int evaluate)
int len, flags = 0;
char_u *p;
char_u name[20];
partial_T *pt;
sprintf((char*)name, "<lambda>%d", ++lambda_no);
@@ -261,10 +261,7 @@ get_lambda_tv(char_u **arg, typval_T *rettv, int evaluate)
goto errret;
pt = (partial_T *)alloc_clear((unsigned)sizeof(partial_T));
if (pt == NULL)
{
vim_free(fp);
goto errret;
}
ga_init2(&newlines, (int)sizeof(char_u *), 1);
if (ga_grow(&newlines, 1) == FAIL)
@@ -318,6 +315,7 @@ errret:
ga_clear_strings(&newargs);
ga_clear_strings(&newlines);
vim_free(fp);
vim_free(pt);
eval_lavars_used = old_eval_lavars;
return FAIL;
}