From: Christian Brabandt <cb@256bit.org>
Date: Thu, 2 Jul 2026 20:01:50 +0000 (+0000)
Subject: patch 9.2.0779: Memory leak in type_name_func() on alloc failure
X-Git-Tag: v9.2.0779^0
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=eeeed2b294da499e63e331f40302ffe9dbf96baa;p=thirdparty%2Fvim.git

patch 9.2.0779: Memory leak in type_name_func() on alloc failure

Problem:  Memory leak in type_name_func() on alloc failure (Ao Xijie)
Solution: Free ret_free variable on failure

related: #20668

Supported by AI.

Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/version.c b/src/version.c
index 05249bea79..1d6c351a70 100644
--- a/src/version.c
+++ b/src/version.c
@@ -759,6 +759,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    779,
 /**/
     778,
 /**/
diff --git a/src/vim9type.c b/src/vim9type.c
index ab34d2535c..dfa6686a98 100644
--- a/src/vim9type.c
+++ b/src/vim9type.c
@@ -2722,13 +2722,16 @@ type_name_func(type_T *type, char **tofree)
 	STRCPY((char *)ga.ga_data + ga.ga_len, ")");
     else
     {
-	char *ret_free;
+	char *ret_free = NULL;
 	char *ret_name = type_name(type->tt_member, &ret_free);
 	int  len;
 
 	len = (int)STRLEN(ret_name) + 4;
 	if (ga_grow(&ga, len) == FAIL)
+	{
+	    vim_free(ret_free);
 	    goto failed;
+	}
 	STRCPY((char *)ga.ga_data + ga.ga_len, "): ");
 	STRCPY((char *)ga.ga_data + ga.ga_len + 3, ret_name);
 	vim_free(ret_free);