From: Christian Brabandt <cb@256bit.org>
Date: Thu, 2 Jul 2026 19:58:13 +0000 (+0000)
Subject: patch 9.2.0778: Memory Leak in compile_dict() on alloc failure
X-Git-Tag: v9.2.0778^0
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8bd30e8cb8507ed51f8a15470d601ebb284fe13b;p=thirdparty%2Fvim.git

patch 9.2.0778: Memory Leak in compile_dict() on alloc failure

Problem:  Memory Leak in compile_dict() on allocation failure (Ao Xijie)
Solution: Use goto failret consistently

related: #20668

Supported by AI.

Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/version.c b/src/version.c
index 70c83e88ae..05249bea79 100644
--- a/src/version.c
+++ b/src/version.c
@@ -759,6 +759,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    778,
 /**/
     777,
 /**/
diff --git a/src/vim9expr.c b/src/vim9expr.c
index a041a3e70a..4331d3f5b0 100644
--- a/src/vim9expr.c
+++ b/src/vim9expr.c
@@ -1930,7 +1930,7 @@ compile_dict(char_u **arg, cctx_T *cctx, ppconst_T *ppconst)
 	    // {[expr]: value} uses an evaluated key.
 	    *arg = skipwhite(*arg + 1);
 	    if (compile_expr0(arg, cctx) == FAIL)
-		return FAIL;
+		goto failret;
 	    isn = ((isn_T *)instr->ga_data) + instr->ga_len - 1;
 	    if (isn->isn_type == ISN_PUSHNR)
 	    {
@@ -1944,12 +1944,12 @@ compile_dict(char_u **arg, cctx_T *cctx, ppconst_T *ppconst)
 	    if (isn->isn_type == ISN_PUSHS)
 		key = isn->isn_arg.string;
 	    else if (may_generate_2STRING(-1, TOSTRING_NONE, cctx) == FAIL)
-		return FAIL;
+		goto failret;
 	    *arg = skipwhite(*arg);
 	    if (**arg != ']')
 	    {
 		emsg(_(e_missing_matching_bracket_after_dict_key));
-		return FAIL;
+		goto failret;
 	    }
 	    ++*arg;
 	}
@@ -1960,9 +1960,9 @@ compile_dict(char_u **arg, cctx_T *cctx, ppconst_T *ppconst)
 	    // {name: value} use "name" as a literal key
 	    key = get_literal_key(arg);
 	    if (key == NULL)
-		return FAIL;
+		goto failret;
 	    if (generate_PUSHS(cctx, &key) == FAIL)
-		return FAIL;
+		goto failret;
 	}
 
 	// Check for duplicate keys, if using string keys.
@@ -1990,13 +1990,13 @@ compile_dict(char_u **arg, cctx_T *cctx, ppconst_T *ppconst)
 		semsg(_(e_no_white_space_allowed_before_str_str), ":", *arg);
 	    else
 		semsg(_(e_missing_colon_in_dictionary_str), *arg);
-	    return FAIL;
+	    goto failret;
 	}
 	whitep = *arg + 1;
 	if (!IS_WHITE_OR_NUL(*whitep))
 	{
 	    semsg(_(e_white_space_required_after_str_str), ":", *arg);
-	    return FAIL;
+	    goto failret;
 	}
 
 	if (may_get_next_line(whitep, arg, cctx) == FAIL)
@@ -2006,7 +2006,7 @@ compile_dict(char_u **arg, cctx_T *cctx, ppconst_T *ppconst)
 	}
 
 	if (compile_expr0_ext(arg, cctx, &is_const) == FAIL)
-	    return FAIL;
+	    goto failret;
 	if (!is_const)
 	    is_all_const = FALSE;
 	++count;
@@ -2027,13 +2027,13 @@ compile_dict(char_u **arg, cctx_T *cctx, ppconst_T *ppconst)
 	if (IS_WHITE_OR_NUL(*whitep))
 	{
 	    semsg(_(e_no_white_space_allowed_before_str_str), ",", whitep);
-	    return FAIL;
+	    goto failret;
 	}
 	whitep = *arg + 1;
 	if (!IS_WHITE_OR_NUL(*whitep))
 	{
 	    semsg(_(e_white_space_required_after_str_str), ",", *arg);
-	    return FAIL;
+	    goto failret;
 	}
 	*arg = skipwhite(whitep);
     }