• R/O
  • SSH

vim: Commit

Mirror of the Vim source from https://github.com/vim/vim


Commit MetaInfo

Revisione01b20e3a720b24c930fd77f1eb8b7d9f1313d05 (tree)
Time2020-06-30 06:30:04
AuthorBram Moolenaar <Bram@vim....>
CommiterBram Moolenaar

Log Message

patch 8.2.1095: may use pointer after freeing it

Commit: https://github.com/vim/vim/commit/6b949615edac2dd33d5e865be8328561f296b045
Author: Bram Moolenaar <Bram@vim.org>
Date: Mon Jun 29 23:18:42 2020 +0200

patch 8.2.1095: may use pointer after freeing it
Problem: May use pointer after freeing it when text properties are used.
Solution: Update redo buffer before calling ml_replace().

Change Summary

Incremental Difference

diff -r 6e6dc7d7b040 -r e01b20e3a720 src/spellsuggest.c
--- a/src/spellsuggest.c Mon Jun 29 23:15:05 2020 +0200
+++ b/src/spellsuggest.c Mon Jun 29 23:30:04 2020 +0200
@@ -676,8 +676,6 @@
676676 mch_memmove(p, line, c);
677677 STRCPY(p + c, stp->st_word);
678678 STRCAT(p, sug.su_badptr + stp->st_orglen);
679- ml_replace(curwin->w_cursor.lnum, p, FALSE);
680- curwin->w_cursor.col = c;
681679
682680 // For redo we use a change-word command.
683681 ResetRedobuff();
@@ -686,7 +684,10 @@
686684 stp->st_wordlen + sug.su_badlen - stp->st_orglen);
687685 AppendCharToRedobuff(ESC);
688686
689- // After this "p" may be invalid.
687+ // "p" may be freed here
688+ ml_replace(curwin->w_cursor.lnum, p, FALSE);
689+ curwin->w_cursor.col = c;
690+
690691 changed_bytes(curwin->w_cursor.lnum, c);
691692 }
692693 }
diff -r 6e6dc7d7b040 -r e01b20e3a720 src/version.c
--- a/src/version.c Mon Jun 29 23:15:05 2020 +0200
+++ b/src/version.c Mon Jun 29 23:30:04 2020 +0200
@@ -755,6 +755,8 @@
755755 static int included_patches[] =
756756 { /* Add new patch number below this line */
757757 /**/
758+ 1095,
759+/**/
758760 1094,
759761 /**/
760762 1093,
Show on old repository browser