From: Christian Brabandt <cb@256bit.org>
Date: Thu, 2 Jul 2026 19:46:18 +0000 (+0000)
Subject: patch 9.2.0775: Memory Leak in highlight_get_info() on alloc failure
X-Git-Tag: v9.2.0775^0
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a424f9846eaf1934d8ae9a9b30d99401970a9bc2;p=thirdparty%2Fvim.git

patch 9.2.0775: Memory Leak in highlight_get_info() on alloc failure

Problem:  Memory Leak in highlight_get_info() on alloc failure
          (Ao Xijie)
Solution: Free attr_dict, on failure using dict_unref() and not
          vim_free()

related: #20668

Supported by AI.

Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/highlight.c b/src/highlight.c
index 08c0bf7304..f2982bacaa 100644
--- a/src/highlight.c
+++ b/src/highlight.c
@@ -5605,7 +5605,7 @@ highlight_get_info(int hl_idx, int resolve_link)
 {
     dict_T	*dict;
     hl_group_T	*sgp;
-    dict_T	*attr_dict;
+    dict_T	*attr_dict = NULL;
     int		hlgid;
 
     dict = dict_alloc();
@@ -5635,8 +5635,11 @@ highlight_get_info(int hl_idx, int resolve_link)
     {
 	attr_dict = highlight_get_attr_dict(sgp->sg_term);
 	if (attr_dict != NULL)
+	{
 	    if (dict_add_dict(dict, "term", attr_dict) == FAIL)
 		goto error;
+	    attr_dict = NULL;
+	}
     }
     if (sgp->sg_start != NULL)
 	if (dict_add_string(dict, "start", sgp->sg_start) == FAIL)
@@ -5648,8 +5651,11 @@ highlight_get_info(int hl_idx, int resolve_link)
     {
 	attr_dict = highlight_get_attr_dict(sgp->sg_cterm);
 	if (attr_dict != NULL)
+	{
 	    if (dict_add_dict(dict, "cterm", attr_dict) == FAIL)
 		goto error;
+	    attr_dict = NULL;
+	}
     }
     if (sgp->sg_cterm_fg != 0)
 	if (dict_add_string(dict, "ctermfg",
@@ -5671,8 +5677,11 @@ highlight_get_info(int hl_idx, int resolve_link)
     {
 	attr_dict = highlight_get_attr_dict(sgp->sg_gui);
 	if (attr_dict != NULL)
+	{
 	    if (dict_add_dict(dict, "gui", attr_dict) == FAIL)
 		goto error;
+	    attr_dict = NULL;
+	}
     }
     if (sgp->sg_gui_fg_name != NULL)
 	if (dict_add_string(dict, "guifg",
@@ -5709,7 +5718,8 @@ highlight_get_info(int hl_idx, int resolve_link)
     return dict;
 
 error:
-    vim_free(dict);
+    dict_unref(attr_dict);
+    dict_unref(dict);
     return NULL;
 }
 
diff --git a/src/version.c b/src/version.c
index a8b8c103dc..7d9eb060fa 100644
--- a/src/version.c
+++ b/src/version.c
@@ -759,6 +759,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    775,
 /**/
     774,
 /**/