From: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Date: Sat, 18 Jul 2026 14:25:10 +0000 (+0000)
Subject: patch 9.2.0798: Memory leak in compile_expr6() on alloc failure
X-Git-Tag: v9.2.0798^0
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4607659b1291d5a7b1a0a94cb4bb02fec33b2902;p=thirdparty%2Fvim.git

patch 9.2.0798: Memory leak in compile_expr6() on alloc failure

Problem:  Memory leak in compile_expr6() on alloc failure
Solution: Free left string when constant string concat alloc fails
          (Yasuhiro Matsumoto).

compile_expr6() overwrote tv1's string pointer before allocating the
concatenation buffer, leaking the original left-hand string on failure.

related: #20668
related: #20745

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/version.c b/src/version.c
index a234bad44f..b3d1e6aed7 100644
--- a/src/version.c
+++ b/src/version.c
@@ -759,6 +759,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    798,
 /**/
     797,
 /**/
diff --git a/src/vim9expr.c b/src/vim9expr.c
index 4331d3f5b0..f69488d5bd 100644
--- a/src/vim9expr.c
+++ b/src/vim9expr.c
@@ -3377,6 +3377,7 @@ compile_expr6(char_u **arg, cctx_T *cctx, ppconst_T *ppconst)
 		tv1->vval.v_string = alloc(len1 + STRLEN(s2) + 1);
 		if (tv1->vval.v_string == NULL)
 		{
+		    vim_free(s1);
 		    clear_ppconst(ppconst);
 		    return FAIL;
 		}