]> git.ipfire.org Git - thirdparty/vim.git/commitdiff
patch 8.2.4632: using freed memory in flatten() v8.2.4632
authorBram Moolenaar <Bram@vim.org>
Sat, 26 Mar 2022 16:42:23 +0000 (16:42 +0000)
committerBram Moolenaar <Bram@vim.org>
Sat, 26 Mar 2022 16:42:23 +0000 (16:42 +0000)
Problem:    Using freed memory in flatten().
Solution:   Clear typval after recursing into list.

src/list.c
src/version.c

index 3354068a4dd18ce9b930461ff026d0a001c0e18a..666fb5ad61011e378d709afa51cb294316b00935 100644 (file)
@@ -953,12 +953,12 @@ list_flatten(list_T *list, listitem_T *first, long maxitems, long maxdepth)
                list_free_item(list, item);
                return;
            }
-           clear_tv(&item->li_tv);
 
            if (maxdepth > 0)
                list_flatten(list, item->li_prev == NULL
                                     ? list->lv_first : item->li_prev->li_next,
                                itemlist->lv_len, maxdepth - 1);
+           clear_tv(&item->li_tv);
            list_free_item(list, item);
        }
 
index 9d78a0e8f780b45b07edb95e8c5abf3fe43d1535..962fa0ba181c2e92335e0f1af02cc451046323c2 100644 (file)
@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4632,
 /**/
     4631,
 /**/