aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-28 04:24:06 -04:00
Code Activity

patch 8.2.1825: Vim9: accessing freed memory

Browse Source 
Problem:    Vim9: accessing freed memory.
Solution:   Clear sv_name when the variable is deleted.
This commit is contained in:
Bram Moolenaar
2020-10-10 20:31:37 +02:00
parent fcdc5d83fb
commit d747548c66
2 changed files with 21 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/ex_eval.c
View File

@@ -926,21 +926,27 @@ leave_block(cstack_T *cstack)
if (in_vim9script()) if (in_vim9script())
{ {
scriptitem_T *si = SCRIPT_ITEM(current_sctx.sc_sid); scriptitem_T *si = SCRIPT_ITEM(current_sctx.sc_sid);
hashtab_T *ht = get_script_local_ht();
if (ht != NULL)
{
for (i = cstack->cs_script_var_len[cstack->cs_idx]; for (i = cstack->cs_script_var_len[cstack->cs_idx];
i < si->sn_var_vals.ga_len; ++i) i < si->sn_var_vals.ga_len; ++i)
{ {
svar_T *sv = ((svar_T *)si->sn_var_vals.ga_data) + i; svar_T *sv = ((svar_T *)si->sn_var_vals.ga_data) + i;
hashtab_T *ht = get_script_local_ht();
hashitem_T *hi; hashitem_T *hi;
if (ht != NULL) if (sv->sv_name != NULL)
{ {
// Remove a variable declared inside the block, if it still // Remove a variable declared inside the block, if it still
// exists. // exists.
hi = hash_find(ht, sv->sv_name); hi = hash_find(ht, sv->sv_name);
if (!HASHITEM_EMPTY(hi)) if (!HASHITEM_EMPTY(hi))
{
delete_var(ht, hi); delete_var(ht, hi);
sv->sv_name = NULL;
}
}
} }
} }
} }

2
src/version.c
View File

@@ -750,6 +750,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
1825,
/**/ /**/
1824, 1824,
/**/ /**/