patch 9.2.0808: getregionpos: double-free on alloc failure

Problem:  getregionpos: double-free on alloc failure
Solution: Only free lists that were not appended (Yasuhiro Matsumoto).

add_regionpos_range() freed lists already linked into the result tree when
a later list_alloc()/list_append_list() failed, causing a double-free and
use-after-free. Only free lists that were not appended, and free them with
list_free() so they are unlinked from the garbage-collection chain.

related: #20668
closes:  #20744

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/evalfunc.c b/src/evalfunc.c
index de52668e5b7b3e2a5d805ac775ab6bfeb78bdbdd..bad28de7cc555908e37821df2a5d04c0bb081c69 100644 (file)
--- a/src/evalfunc.c
+++ b/src/evalfunc.c
@@ -6395,37 +6395,27 @@ add_regionpos_range(typval_T *rettv, pos_T p1, pos_T p2)
 
     if (list_append_list(rettv->vval.v_list, l1) == FAIL)
     {
-       vim_free(l1);
+       list_free(l1);
        return;
     }
 
     l2 = list_alloc();
     if (l2 == NULL)
-    {
-       vim_free(l1);
        return;
-    }
 
     if (list_append_list(l1, l2) == FAIL)
     {
-       vim_free(l1);
-       vim_free(l2);
+       list_free(l2);
        return;
     }
 
     l3 = list_alloc();
     if (l3 == NULL)
-    {
-       vim_free(l1);
-       vim_free(l2);
        return;
-    }
 
     if (list_append_list(l1, l3) == FAIL)
     {
-       vim_free(l1);
-       vim_free(l2);
-       vim_free(l3);
+       list_free(l3);
        return;
     }
 

diff --git a/src/version.c b/src/version.c
index 84792148b35de1f3f9a1fcb2402a9119208c2f2d..3196d57cb9a4049cc99e4a2d655344f4072c0049 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -759,6 +759,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    808,
 /**/
     807,
 /**/