From: Yasuhiro Matsumoto Date: Sun, 19 Jul 2026 16:13:29 +0000 (+0000) Subject: patch 9.2.0809: getframelayout() uses wrong function to free lists X-Git-Tag: v9.2.0809^0 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=75efa96ab3c8d1717c3f817eceae9471b1d54c8b;p=thirdparty%2Fvim.git patch 9.2.0809: getframelayout() uses wrong function to free lists Problem: getframelayout() uses wrong function to free lists on alloc failure. Solution: Use list_free() on alloc failure (Yasuhiro Matsumoto). get_framelayout() released a list_alloc()'d list with vim_free() when list_append_list() failed, leaving a dangling pointer in the list garbage-collection chain. Use list_free() so it is unlinked. related: #20668 related: #20743 Signed-off-by: Yasuhiro Matsumoto Signed-off-by: Christian Brabandt --- diff --git a/src/evalwindow.c b/src/evalwindow.c index f913980404..9c56954b8b 100644 --- a/src/evalwindow.c +++ b/src/evalwindow.c @@ -284,7 +284,7 @@ get_framelayout(frame_T *fr, list_T *l, int outer) return; if (list_append_list(l, fr_list) == FAIL) { - vim_free(fr_list); + list_free(fr_list); return; } } @@ -309,7 +309,7 @@ get_framelayout(frame_T *fr, list_T *l, int outer) return; if (list_append_list(fr_list, win_list) == FAIL) { - vim_free(win_list); + list_free(win_list); return; } diff --git a/src/version.c b/src/version.c index 3196d57cb9..aa3f5b3fbd 100644 --- a/src/version.c +++ b/src/version.c @@ -759,6 +759,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 809, /**/ 808, /**/