0
0
mirror of https://github.com/vim/vim.git synced 2025-09-24 03:44:06 -04:00

patch 8.2.4587: Vim9: double free after unpacking a list

Problem:    Vim9: double free after unpacking a list.
Solution:   Make a copy of the value instead of moving it. (closes #9968)
This commit is contained in:
Bram Moolenaar
2022-03-18 13:10:48 +00:00
parent 1d9cef769d
commit 61efa16932
3 changed files with 13 additions and 1 deletions

View File

@@ -2253,6 +2253,13 @@ def Test_for_loop_unpack()
res->add(n) res->add(n)
endfor endfor
assert_equal([2, 5], res) assert_equal([2, 5], res)
var text: list<string> = ["hello there", "goodbye now"]
var splitted = ''
for [first; next] in mapnew(text, (i, v) => split(v))
splitted ..= string(first) .. string(next) .. '/'
endfor
assert_equal("'hello'['there']/'goodbye'['now']/", splitted)
END END
v9.CheckDefAndScriptSuccess(lines) v9.CheckDefAndScriptSuccess(lines)

View File

@@ -750,6 +750,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
4587,
/**/ /**/
4586, 4586,
/**/ /**/

View File

@@ -4773,7 +4773,10 @@ exec_instructions(ectx_T *ectx)
li = li->li_next; li = li->li_next;
for (i = 0; li != NULL; ++i) for (i = 0; li != NULL; ++i)
{ {
list_set_item(rem_list, i, &li->li_tv); typval_T tvcopy;
copy_tv(&li->li_tv, &tvcopy);
list_set_item(rem_list, i, &tvcopy);
li = li->li_next; li = li->li_next;
} }
--count; --count;