aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-24 03:44:06 -04:00
Code Activity

patch 8.2.4863: accessing freed memory in test without the +channel feature

Browse Source 
Problem:    Accessing freed memory in test without the +channel feature.
            (Dominique Pellé)
Solution:   Do not generted PUSHCHANNEL or PUSHJOB if they are not
            implemented. (closes #10350)
This commit is contained in:
Bram Moolenaar
2022-05-04 16:46:54 +01:00
parent 23d44493f1
commit c9af617ac6
5 changed files with 45 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
src/vim9compile.c
View File

@@ -2293,39 +2293,41 @@ compile_assignment(char_u *arg, exarg_T *eap, cmdidx_T cmdidx, cctx_T *cctx)
}
else
{
int r = OK;
// variables are always initialized
if (GA_GROW_FAILS(instr, 1))
goto theend;
switch (lhs.lhs_member_type->tt_type)
{
case VAR_BOOL:
generate_PUSHBOOL(cctx, VVAL_FALSE);
r = generate_PUSHBOOL(cctx, VVAL_FALSE);
break;
case VAR_FLOAT:
#ifdef FEAT_FLOAT
generate_PUSHF(cctx, 0.0);
r = generate_PUSHF(cctx, 0.0);
#endif
break;
case VAR_STRING:
generate_PUSHS(cctx, NULL);
r = generate_PUSHS(cctx, NULL);
break;
case VAR_BLOB:
generate_PUSHBLOB(cctx, blob_alloc());
r = generate_PUSHBLOB(cctx, blob_alloc());
break;
case VAR_FUNC:
generate_PUSHFUNC(cctx, NULL, &t_func_void);
r = generate_PUSHFUNC(cctx, NULL, &t_func_void);
break;
case VAR_LIST:
generate_NEWLIST(cctx, 0, FALSE);
r = generate_NEWLIST(cctx, 0, FALSE);
break;
case VAR_DICT:
generate_NEWDICT(cctx, 0, FALSE);
r = generate_NEWDICT(cctx, 0, FALSE);
break;
case VAR_JOB:
generate_PUSHJOB(cctx);
r = generate_PUSHJOB(cctx);
break;
case VAR_CHANNEL:
generate_PUSHCHANNEL(cctx);
r = generate_PUSHCHANNEL(cctx);
break;
case VAR_NUMBER:
case VAR_UNKNOWN:
@@ -2343,10 +2345,12 @@ compile_assignment(char_u *arg, exarg_T *eap, cmdidx_T cmdidx, cctx_T *cctx)
else
{
instr_count = instr->ga_len;
generate_PUSHNR(cctx, 0);
r = generate_PUSHNR(cctx, 0);
}
break;
}
if (r == FAIL)
goto theend;
}
if (var_count == 0)
end = p;