]> git.ipfire.org Git - thirdparty/vim.git/commit
patch 9.2.0618: use-after-free in popup_getoptions() on dict_add() failure v9.2.0618
authorYasuhiro Matsumoto <mattn.jp@gmail.com>
Wed, 10 Jun 2026 20:55:06 +0000 (20:55 +0000)
committerChristian Brabandt <cb@256bit.org>
Wed, 10 Jun 2026 20:55:06 +0000 (20:55 +0000)
commitf202f6ca95220cd7915e80bb8d81e0e70082faaa
tree9549e0421438fe3c63f9ae7aab1b74ca5cebdfc2
parent39d063931b21b6afdc6d7c4d3d29d9df2e044aee
patch 9.2.0618: use-after-free in popup_getoptions() on dict_add() failure

Problem:  use-after-free in popup_getoptions() on dict_add() failure
Solution: Set b to NULL (Yasuhiro Matsumoto).

When dict_add() failed, dictitem_free() unref'd and freed the blob, but
the error cleanup then read the freed blob's refcount and could free it
again. Clear the pointer after dictitem_free().

closes: #20464

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
src/popupwin.c
src/version.c