From: Bram Moolenaar <Bram@vim.org>
Date: Sat, 26 Mar 2022 16:42:23 +0000 (+0000)
Subject: patch 8.2.4632: using freed memory in flatten()
X-Git-Tag: v8.2.4632
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f3980dc5d0a5f873cf764b8ba3e567e42259e4e5;p=thirdparty%2Fvim.git

patch 8.2.4632: using freed memory in flatten()

Problem:    Using freed memory in flatten().
Solution:   Clear typval after recursing into list.
---

diff --git a/src/list.c b/src/list.c
index 3354068a4d..666fb5ad61 100644
--- a/src/list.c
+++ b/src/list.c
@@ -953,12 +953,12 @@ list_flatten(list_T *list, listitem_T *first, long maxitems, long maxdepth)
 		list_free_item(list, item);
 		return;
 	    }
-	    clear_tv(&item->li_tv);
 
 	    if (maxdepth > 0)
 		list_flatten(list, item->li_prev == NULL
 				     ? list->lv_first : item->li_prev->li_next,
 				itemlist->lv_len, maxdepth - 1);
+	    clear_tv(&item->li_tv);
 	    list_free_item(list, item);
 	}
 
diff --git a/src/version.c b/src/version.c
index 9d78a0e8f7..962fa0ba18 100644
--- a/src/version.c
+++ b/src/version.c
@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4632,
 /**/
     4631,
 /**/