patch 8.2.3246: memory use after free

Problem:    Memory use after free.
Solution:   When clearing a string option set the pointer to "empty_option".

diff --git a/src/option.c b/src/option.c
index 182ff341cf37dad0b367d5a877c32f4bc3dee0a9..decba501a91d0c972b7c2bbe288eb168dee6afcc 100644 (file)
--- a/src/option.c
+++ b/src/option.c
@@ -807,7 +807,7 @@ free_all_options(void)
        else if (options[i].var != VAR_WIN
                && (options[i].flags & P_STRING))
            // buffer-local option: free global value
-           free_string_option(*(char_u **)options[i].var);
+           clear_string_option((char_u **)options[i].var);
     }
 }
 #endif

diff --git a/src/version.c b/src/version.c
index 6b372008c54a8a2fbdfc43f85053a1b210b7dab5..7710018b3158dd6b882fc2e670ea972b176a29b5 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -755,6 +755,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    3246,
 /**/
     3245,
 /**/