From: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Date: Mon, 20 Jul 2026 16:02:56 +0000 (+0000)
Subject: patch 9.2.0813: dict_add_func() may corrupt funcref count on failure
X-Git-Tag: v9.2.0813^0
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4a403b48c653461f3c2fa331664d68585f59ea4c;p=thirdparty%2Fvim.git

patch 9.2.0813: dict_add_func() may corrupt funcref count on failure

Problem:  dict_add_func() references the function only after a
          successful dict_add(), on failure dictitem_free()
          calls func_unref() without a matching func_ref(), corrupting
          the reference count of a lambda or numbered function.
Solution: Take the reference before dict_add() so the unref on the
          failure path is balanced (Yasuhiro Matsumoto).

related: #20668
closes:  #20742

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/dict.c b/src/dict.c
index ac1fb3841b..5531cc72a0 100644
--- a/src/dict.c
+++ b/src/dict.c
@@ -552,12 +552,13 @@ dict_add_func(dict_T *d, char *key, ufunc_T *fp)
 	return FAIL;
     item->di_tv.v_type = VAR_FUNC;
     item->di_tv.vval.v_string = vim_strnsave(fp->uf_name, fp->uf_namelen);
+    // Reference before dict_add() so dictitem_free()'s unref stays balanced on failure.
+    func_ref(item->di_tv.vval.v_string);
     if (dict_add(d, item) == FAIL)
     {
 	dictitem_free(item);
 	return FAIL;
     }
-    func_ref(item->di_tv.vval.v_string);
     return OK;
 }
 
diff --git a/src/version.c b/src/version.c
index 333bbc87d8..178090f6b1 100644
--- a/src/version.c
+++ b/src/version.c
@@ -759,6 +759,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    813,
 /**/
     812,
 /**/