patch 9.2.0798: Memory leak in compile_expr6() on alloc failure

Problem:  Memory leak in compile_expr6() on alloc failure
Solution: Free left string when constant string concat alloc fails
          (Yasuhiro Matsumoto).

compile_expr6() overwrote tv1's string pointer before allocating the
concatenation buffer, leaking the original left-hand string on failure.

related: #20668
related: #20745

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/version.c b/src/version.c
index a234bad44fddabee15463703abffbb3fc3bed3da..b3d1e6aed7dbf79e3b79345022d06d5a073fa274 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -759,6 +759,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    798,
 /**/
     797,
 /**/

diff --git a/src/vim9expr.c b/src/vim9expr.c
index 4331d3f5b0d5a0c83b1ea05639a2767784b78a47..f69488d5bdbf899e1f218de6ca363c1b11e28c86 100644 (file)
--- a/src/vim9expr.c
+++ b/src/vim9expr.c
@@ -3377,6 +3377,7 @@ compile_expr6(char_u **arg, cctx_T *cctx, ppconst_T *ppconst)
                tv1->vval.v_string = alloc(len1 + STRLEN(s2) + 1);
                if (tv1->vval.v_string == NULL)
                {
+                   vim_free(s1);
                    clear_ppconst(ppconst);
                    return FAIL;
                }