patch 8.2.0825: def_function() may return pointer that was freed

Problem:    def_function() may return pointer that was freed.
Solution:   Set "fp" to NULL after freeing it.

diff --git a/src/userfunc.c b/src/userfunc.c
index 87e06c61da26b3c52e317593bfa9354b9fcdfeb9..c50a871c2b64e64e87262ded6b6ccd75006b65a8 100644 (file)
--- a/src/userfunc.c
+++ b/src/userfunc.c
@@ -3140,12 +3140,14 @@ def_function(exarg_T *eap, char_u *name_arg)
                if (fudi.fd_di == NULL)
                {
                    vim_free(fp);
+                   fp = NULL;
                    goto erret;
                }
                if (dict_add(fudi.fd_dict, fudi.fd_di) == FAIL)
                {
                    vim_free(fudi.fd_di);
                    vim_free(fp);
+                   fp = NULL;
                    goto erret;
                }
            }
@@ -3169,6 +3171,7 @@ def_function(exarg_T *eap, char_u *name_arg)
        else if (hash_add(&func_hashtab, UF2HIKEY(fp)) == FAIL)
        {
            vim_free(fp);
+           fp = NULL;
            goto erret;
        }
        fp->uf_refcount = 1;

diff --git a/src/version.c b/src/version.c
index ce5f627ca26ae0672699529bde7e3e2aa74bb372..5ccbfad01e0069f751c19b48af5326a41d9f6ada 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -746,6 +746,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    825,
 /**/
     824,
 /**/