patch 9.2.0779: Memory leak in type_name_func() on alloc failure

Problem:  Memory leak in type_name_func() on alloc failure (Ao Xijie)
Solution: Free ret_free variable on failure

related: #20668

Supported by AI.

Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/version.c b/src/version.c
index 05249bea795b9f7fa33adc969baf0ee89ce2a298..1d6c351a70b6e26e729f38bf6659822c911d0021 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -759,6 +759,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    779,
 /**/
     778,
 /**/

diff --git a/src/vim9type.c b/src/vim9type.c
index ab34d2535c122912cdfabfe71c5e50f344243d93..dfa6686a980114ff6f5868ff2d6e5094091cab30 100644 (file)
--- a/src/vim9type.c
+++ b/src/vim9type.c
@@ -2722,13 +2722,16 @@ type_name_func(type_T *type, char **tofree)
        STRCPY((char *)ga.ga_data + ga.ga_len, ")");
     else
     {
-       char *ret_free;
+       char *ret_free = NULL;
        char *ret_name = type_name(type->tt_member, &ret_free);
        int  len;
 
        len = (int)STRLEN(ret_name) + 4;
        if (ga_grow(&ga, len) == FAIL)
+       {
+           vim_free(ret_free);
            goto failed;
+       }
        STRCPY((char *)ga.ga_data + ga.ga_len, "): ");
        STRCPY((char *)ga.ga_data + ga.ga_len + 3, ret_name);
        vim_free(ret_free);