aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-28 04:24:06 -04:00
Code Activity

patch 8.2.1095: may use pointer after freeing it

Browse Source 
Problem:    May use pointer after freeing it when text properties are used.
Solution:   Update redo buffer before calling ml_replace().
This commit is contained in:
Bram Moolenaar
2020-06-29 23:18:42 +02:00
parent a53618dd1d
commit 6b949615ed
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/spellsuggest.c
View File

@@ -676,8 +676,6 @@ spell_suggest(int count)
mch_memmove(p, line, c); mch_memmove(p, line, c);
STRCPY(p + c, stp->st_word); STRCPY(p + c, stp->st_word);
STRCAT(p, sug.su_badptr + stp->st_orglen); STRCAT(p, sug.su_badptr + stp->st_orglen);
ml_replace(curwin->w_cursor.lnum, p, FALSE);
curwin->w_cursor.col = c;
// For redo we use a change-word command. // For redo we use a change-word command.
ResetRedobuff(); ResetRedobuff();
@@ -686,7 +684,10 @@ spell_suggest(int count)
stp->st_wordlen + sug.su_badlen - stp->st_orglen); stp->st_wordlen + sug.su_badlen - stp->st_orglen);
AppendCharToRedobuff(ESC); AppendCharToRedobuff(ESC);
// After this "p" may be invalid. // "p" may be freed here
ml_replace(curwin->w_cursor.lnum, p, FALSE);
curwin->w_cursor.col = c;
changed_bytes(curwin->w_cursor.lnum, c); changed_bytes(curwin->w_cursor.lnum, c);
} }
} }

2
src/version.c
View File

@@ -754,6 +754,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
1095,
/**/ /**/
1094, 1094,
/**/ /**/