From eeeed2b294da499e63e331f40302ffe9dbf96baa Mon Sep 17 00:00:00 2001 From: Christian Brabandt Date: Thu, 2 Jul 2026 20:01:50 +0000 Subject: [PATCH] patch 9.2.0779: Memory leak in type_name_func() on alloc failure Problem: Memory leak in type_name_func() on alloc failure (Ao Xijie) Solution: Free ret_free variable on failure related: #20668 Supported by AI. Signed-off-by: Christian Brabandt --- src/version.c | 2 ++ src/vim9type.c | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/src/version.c b/src/version.c index 05249bea79..1d6c351a70 100644 --- a/src/version.c +++ b/src/version.c @@ -759,6 +759,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 779, /**/ 778, /**/ diff --git a/src/vim9type.c b/src/vim9type.c index ab34d2535c..dfa6686a98 100644 --- a/src/vim9type.c +++ b/src/vim9type.c @@ -2722,13 +2722,16 @@ type_name_func(type_T *type, char **tofree) STRCPY((char *)ga.ga_data + ga.ga_len, ")"); else { - char *ret_free; + char *ret_free = NULL; char *ret_name = type_name(type->tt_member, &ret_free); int len; len = (int)STRLEN(ret_name) + 4; if (ga_grow(&ga, len) == FAIL) + { + vim_free(ret_free); goto failed; + } STRCPY((char *)ga.ga_data + ga.ga_len, "): "); STRCPY((char *)ga.ga_data + ga.ga_len + 3, ret_name); vim_free(ret_free); -- 2.47.3