aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-23 03:43:49 -04:00
Code Activity

patch 8.0.0085

Browse Source 
Problem:    Using freed memory with recursive function call. (Dominique Pelle)
Solution:   Make a copy of the function name.
This commit is contained in:
Bram Moolenaar
2016-11-14 21:50:00 +01:00
parent 7618e00d3b
commit 8a01f969c1
3 changed files with 36 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/eval.c
View File

@@ -4339,10 +4339,17 @@ eval7(
* use its contents. */
s = deref_func_name(s, &len, &partial, !evaluate);
/* Invoke the function. */
ret = get_func_tv(s, len, rettv, arg,
curwin->w_cursor.lnum, curwin->w_cursor.lnum,
&len, evaluate, partial, NULL);
/* Need to make a copy, in case evaluating the arguments makes
* the name invalid. */
s = vim_strsave(s);
if (s == NULL)
ret = FAIL;
else
/* Invoke the function. */
ret = get_func_tv(s, len, rettv, arg,
curwin->w_cursor.lnum, curwin->w_cursor.lnum,
&len, evaluate, partial, NULL);
vim_free(s);
/* If evaluate is FALSE rettv->v_type was not set in
* get_func_tv, but it's needed in handle_subscript() to parse