aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-23 03:43:49 -04:00
Code Activity

patch 8.0.1218: writing to freed memory in autocmd

Browse Source 
Problem:    Writing to freed memory in autocmd.
Solution:   Make a copy of the tag line. (Dominique Pelle, closes #2245)
This commit is contained in:
Bram Moolenaar
2017-10-26 16:42:16 +02:00
parent d99388ba85
commit 8d84ff1a3c
3 changed files with 54 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
src/tag.c
View File

@@ -2949,6 +2949,25 @@ test_for_static(tagptrs_T *tagp)
return FALSE;
}
/*
* Returns the length of a matching tag line.
*/
static size_t
matching_line_len(char_u *lbuf)
{
char_u *p = lbuf + 1;
/* does the same thing as parse_match() */
p += STRLEN(p) + 2;
#ifdef FEAT_EMACS_TAGS
if (*p)
p += STRLEN(p);
else
++p;
#endif
return (p - lbuf) + STRLEN(p);
}
/*
* Parse a line from a matching tag. Does not change the line itself.
*
@@ -3071,7 +3090,7 @@ tag_full_fname(tagptrs_T *tagp)
*/
static int
jumpto_tag(
char_u *lbuf, /* line from the tags file for this tag */
char_u *lbuf_arg, /* line from the tags file for this tag */
int forceit, /* :ta with ! */
int keep_help) /* keep help flag (FALSE for cscope) */
{
@@ -3079,7 +3098,6 @@ jumpto_tag(
int save_magic;
int save_p_ws, save_p_scs, save_p_ic;
linenr_T save_lnum;
int csave = 0;
char_u *str;
char_u *pbuf; /* search pattern buffer */
char_u *pbuf_end;
@@ -3099,18 +3117,26 @@ jumpto_tag(
#ifdef FEAT_FOLDING
int old_KeyTyped = KeyTyped; /* getting the file may reset it */
#endif
size_t len;
char_u *lbuf;
/* Make a copy of the line, it can become invalid when an autocommand calls
* back here recursively. */
len = matching_line_len(lbuf_arg) + 1;
lbuf = alloc((int)len);
if (lbuf != NULL)
mch_memmove(lbuf, lbuf_arg, len);
pbuf = alloc(LSIZE);
/* parse the match line into the tagp structure */
if (pbuf == NULL || parse_match(lbuf, &tagp) == FAIL)
if (pbuf == NULL || lbuf == NULL || parse_match(lbuf, &tagp) == FAIL)
{
tagp.fname_end = NULL;
goto erret;
}
/* truncate the file name, so it can be used as a string */
csave = *tagp.fname_end;
*tagp.fname_end = NUL;
fname = tagp.fname;
@@ -3246,7 +3272,10 @@ jumpto_tag(
#endif
keep_help_flag = curbuf->b_help;
}
if (getfile_result == GETFILE_UNUSED)
/* Careful: getfile() may trigger autocommands and call jumpto_tag()
* recursively. */
getfile_result = getfile(0, fname, NULL, TRUE, (linenr_T)0, forceit);
keep_help_flag = FALSE;
@@ -3441,8 +3470,7 @@ erret:
#if defined(FEAT_QUICKFIX)
g_do_tagpreview = 0; /* For next time */
#endif
if (tagp.fname_end != NULL)
*tagp.fname_end = csave;
vim_free(lbuf);
vim_free(pbuf);
vim_free(tofree_fname);
vim_free(full_fname);