From: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Date: Sun, 19 Jul 2026 16:02:10 +0000 (+0000)
Subject: patch 9.2.0808: getregionpos: double-free on alloc failure
X-Git-Tag: v9.2.0808^0
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=bf1e87597900d35e131fdcd045462343b712960f;p=thirdparty%2Fvim.git

patch 9.2.0808: getregionpos: double-free on alloc failure

Problem:  getregionpos: double-free on alloc failure
Solution: Only free lists that were not appended (Yasuhiro Matsumoto).

add_regionpos_range() freed lists already linked into the result tree when
a later list_alloc()/list_append_list() failed, causing a double-free and
use-after-free. Only free lists that were not appended, and free them with
list_free() so they are unlinked from the garbage-collection chain.

related: #20668
closes:  #20744

Signed-off-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/evalfunc.c b/src/evalfunc.c
index de52668e5b..bad28de7cc 100644
--- a/src/evalfunc.c
+++ b/src/evalfunc.c
@@ -6395,37 +6395,27 @@ add_regionpos_range(typval_T *rettv, pos_T p1, pos_T p2)
 
     if (list_append_list(rettv->vval.v_list, l1) == FAIL)
     {
-	vim_free(l1);
+	list_free(l1);
 	return;
     }
 
     l2 = list_alloc();
     if (l2 == NULL)
-    {
-	vim_free(l1);
 	return;
-    }
 
     if (list_append_list(l1, l2) == FAIL)
     {
-	vim_free(l1);
-	vim_free(l2);
+	list_free(l2);
 	return;
     }
 
     l3 = list_alloc();
     if (l3 == NULL)
-    {
-	vim_free(l1);
-	vim_free(l2);
 	return;
-    }
 
     if (list_append_list(l1, l3) == FAIL)
     {
-	vim_free(l1);
-	vim_free(l2);
-	vim_free(l3);
+	list_free(l3);
 	return;
     }
 
diff --git a/src/version.c b/src/version.c
index 84792148b3..3196d57cb9 100644
--- a/src/version.c
+++ b/src/version.c
@@ -759,6 +759,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    808,
 /**/
     807,
 /**/