patch 9.2.0771: dict_add_list() has inconsistent ownership on failure

Problem:  dict_add_list() frees the passed list on failure path
          (when dict_add() fails) but not on the other (when
          dictitem_alloc() fails), so a caller cannot tell whether it
          still owns the list after a failure.
Solution: On failure leave the passed list untouched and owned by the
          caller; only take a reference on success.

related: #20668

Supported by AI.

Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/dict.c b/src/dict.c
index c34ce2981469d5ca982694c9e7dc5df268b60542..11063950859baa2e63f94f608150721f1aa149a0 100644 (file)
--- a/src/dict.c
+++ b/src/dict.c
@@ -484,12 +484,15 @@ dict_add_list(dict_T *d, char *key, list_T *list)
        return FAIL;
     item->di_tv.v_type = VAR_LIST;
     item->di_tv.vval.v_list = list;
-    ++list->lv_refcount;
     if (dict_add(d, item) == FAIL)
     {
+       // Detach "list" so dictitem_free() does not unref it: on failure
+       // ownership stays with the caller.
+       item->di_tv.vval.v_list = NULL;
        dictitem_free(item);
        return FAIL;
     }
+    ++list->lv_refcount;
     return OK;
 }
 

diff --git a/src/version.c b/src/version.c
index c50ea41624959f7287f94a4cf2e25b435b552009..7fa823e7dcc2a27a3b0c8b6c7dadc8913087db44 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -759,6 +759,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    771,
 /**/
     770,
 /**/