updated for version 7.3.916

Problem:    Using freed memory when pasting with the mouse (Issue 130).
Solution:   Get the byte value early. (hint by Dominique Pelle)

diff --git a/src/buffer.c b/src/buffer.c
index 5ee6299901b973ca537d042db62771bd4e4dba1e..1840e10961730a34780b23ddbea96e81508ba3e1 100644 (file)
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -3506,7 +3506,7 @@ build_stl_str_hl(wp, out, outlen, fmt, use_sandbox, fillchar,
     char_u     *p;
     char_u     *s;
     char_u     *t;
-    char_u     *linecont;
+    int                byteval;
 #ifdef FEAT_EVAL
     win_T      *o_curwin;
     buf_T      *o_curbuf;
@@ -3573,12 +3573,21 @@ build_stl_str_hl(wp, out, outlen, fmt, use_sandbox, fillchar,
        fillchar = '-';
 #endif
 
-    /*
-     * Get line & check if empty (cursorpos will show "0-1").
-     * If inversion is possible we use it. Else '=' characters are used.
-     */
-    linecont = ml_get_buf(wp->w_buffer, wp->w_cursor.lnum, FALSE);
-    empty_line = (*linecont == NUL);
+    /* Get line & check if empty (cursorpos will show "0-1").  Note that
+     * p will become invalid when getting another buffer line. */
+    p = ml_get_buf(wp->w_buffer, wp->w_cursor.lnum, FALSE);
+    empty_line = (*p == NUL);
+
+    /* Get the byte value now, in case we need it below. This is more
+     * efficient than making a copy of the line. */
+    if (wp->w_cursor.col > (colnr_T)STRLEN(p))
+       byteval = 0;
+    else
+#ifdef FEAT_MBYTE
+       byteval = (*mb_ptr2char)(p + wp->w_cursor.col);
+#else
+       byteval = p[wp->w_cursor.col];
+#endif
 
     groupdepth = 0;
     p = out;
@@ -3956,16 +3965,7 @@ build_stl_str_hl(wp, out, outlen, fmt, use_sandbox, fillchar,
        case STL_BYTEVAL_X:
            base = 'X';
        case STL_BYTEVAL:
-           if (wp->w_cursor.col > (colnr_T)STRLEN(linecont))
-               num = 0;
-           else
-           {
-#ifdef FEAT_MBYTE
-               num = (*mb_ptr2char)(linecont + wp->w_cursor.col);
-#else
-               num = linecont[wp->w_cursor.col];
-#endif
-           }
+           num = byteval;
            if (num == NL)
                num = 0;
            else if (num == CAR && get_fileformat(wp->w_buffer) == EOL_MAC)

diff --git a/src/version.c b/src/version.c
index fef8b9bef9400280af04ce2728d161a686c6919d..3450db4a918d0d1290bb63bc9e91927c0560ee8f 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -728,6 +728,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    916,
 /**/
     915,
 /**/