From: glepnir <glephunter@gmail.com>
Date: Thu, 14 Aug 2025 19:15:44 +0000 (+0200)
Subject: patch 9.1.1632: memory leak in fuzzy.c
X-Git-Tag: v9.1.1632^0
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=03d6e06edd0aaf2f591d74349cb25dbeca5895ef;p=thirdparty%2Fvim.git

patch 9.1.1632: memory leak in fuzzy.c

Problem:  memory leak in fuzzy.c
Solution: Free fuzmatch, add a few minor refactors
          (glepnir)

fixes neovim CID 584055: fuzmatch leak when count becomes 0
Fix partial allocation failure cleanup in buffer expansion

closes: #17996

Signed-off-by: glepnir <glephunter@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/buffer.c b/src/buffer.c
index 1ca561fce2..5937a9e12d 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -2971,7 +2971,11 @@ ExpandBufnames(
 	    else
 		p = vim_strsave(p);
 	    if (p == NULL)
+	    {
+		if (fuzzy && round == 2)
+		    fuzmatch_str_free(fuzmatch, count);
 		return FAIL;
+	    }
 
 	    if (!fuzzy)
 	    {
diff --git a/src/fuzzy.c b/src/fuzzy.c
index c1b216ce59..47407644eb 100644
--- a/src/fuzzy.c
+++ b/src/fuzzy.c
@@ -868,11 +868,10 @@ search_for_fuzzy_match(
     void
 fuzmatch_str_free(fuzmatch_str_T *fuzmatch, int count)
 {
-    int i;
-
     if (fuzmatch == NULL)
 	return;
-    for (i = 0; i < count; ++i)
+
+    for (int i = 0; i < count; ++i)
 	vim_free(fuzmatch[i].str);
     vim_free(fuzmatch);
 }
@@ -892,7 +891,7 @@ fuzzymatches_to_strmatches(
     int		i;
 
     if (count <= 0)
-	return OK;
+	goto theend;
 
     *matches = ALLOC_MULT(char_u *, count);
     if (*matches == NULL)
@@ -909,8 +908,9 @@ fuzzymatches_to_strmatches(
 
     for (i = 0; i < count; i++)
 	(*matches)[i] = fuzmatch[i].str;
-    vim_free(fuzmatch);
 
+theend:
+    vim_free(fuzmatch);
     return OK;
 }
 
diff --git a/src/version.c b/src/version.c
index 2f6fbeb82b..4f6c708431 100644
--- a/src/version.c
+++ b/src/version.c
@@ -719,6 +719,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1632,
 /**/
     1631,
 /**/