From: glepnir <glephunter@gmail.com>
Date: Tue, 28 Apr 2026 19:14:22 +0000 (+0000)
Subject: patch 9.2.0409: memory leaks in copy_substring_from_pos()
X-Git-Tag: v9.2.0409^0
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;p=thirdparty%2Fvim.git

patch 9.2.0409: memory leaks in copy_substring_from_pos()

Problem:  Memory leak in error path of copy_substring_from_pos().
Solution: Free the garray on OOM in copy_substring_from_pos()
          (glepnir).

closes: #20086

Signed-off-by: glepnir <glephunter@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/cmdexpand.c b/src/cmdexpand.c
index 478cda25a0..2a8bd31b23 100644
--- a/src/cmdexpand.c
+++ b/src/cmdexpand.c
@@ -4771,7 +4771,7 @@ copy_substring_from_pos(pos_T *start, pos_T *end, char_u **match,
     segment_len = is_single_line ? (end->col - start->col)
 			: (int)(ml_get_len(start->lnum) - start->col);
     if (ga_grow(&ga, segment_len + 2) != OK)
-	return FAIL;
+	goto fail;
 
     ga_concat_len(&ga, start_ptr, segment_len);
     if (!is_single_line)
@@ -4806,13 +4806,13 @@ copy_substring_from_pos(pos_T *start, pos_T *end, char_u **match,
     word_end = find_word_end(end_line + end->col);
     segment_len = (int)(word_end - end_line);
     if (ga_grow(&ga, segment_len) != OK)
-	return FAIL;
+	goto fail;
     ga_concat_len(&ga, end_line + (is_single_line ? end->col : 0),
 	    segment_len - (is_single_line ? end->col : 0));
 
     // Null-terminate
     if (ga_grow(&ga, 1) != OK)
-	return FAIL;
+	goto fail;
     ga_append(&ga, NUL);
 
     *match = (char_u *)ga.ga_data;
@@ -4820,6 +4820,10 @@ copy_substring_from_pos(pos_T *start, pos_T *end, char_u **match,
     match_end->col = segment_len;
 
     return OK;
+
+fail:
+    ga_clear(&ga);
+    return FAIL;
 }
 
 /*
diff --git a/src/version.c b/src/version.c
index 406bccd54d..c1b9f298a8 100644
--- a/src/version.c
+++ b/src/version.c
@@ -729,6 +729,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    409,
 /**/
     408,
 /**/