diff options
| author | Jan Edmund Lazo <jan.lazo@mail.utoronto.ca> | 2020-06-30 00:11:18 -0400 |
|---|---|---|
| committer | Jan Edmund Lazo <jan.lazo@mail.utoronto.ca> | 2020-07-04 10:05:34 -0400 |
| commit | e84c075ad9a8ce1bf5182bd0d4993cd2304cf9e1 (patch) | |
| tree | 028cf6bbac1b781286dab6e02f1fda71906ac690 | |
| parent | f01bb307fdce09452535ada6212a6f37f509e567 (diff) | |
| download | rneovim-e84c075ad9a8ce1bf5182bd0d4993cd2304cf9e1.tar.gz rneovim-e84c075ad9a8ce1bf5182bd0d4993cd2304cf9e1.tar.bz2 rneovim-e84c075ad9a8ce1bf5182bd0d4993cd2304cf9e1.zip | |
vim-patch:8.2.1095: may use pointer after freeing it
Problem: May use pointer after freeing it when text properties are used.
Solution: Update redo buffer before calling ml_replace().
https://github.com/vim/vim/commit/6b949615edac2dd33d5e865be8328561f296b045
| -rw-r--r-- | src/nvim/spell.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/src/nvim/spell.c b/src/nvim/spell.c index 4d8da1ba14..df29124dea 100644 --- a/src/nvim/spell.c +++ b/src/nvim/spell.c @@ -2930,8 +2930,6 @@ void spell_suggest(int count) memmove(p, line, c); STRCPY(p + c, stp->st_word); STRCAT(p, sug.su_badptr + stp->st_orglen); - ml_replace(curwin->w_cursor.lnum, p, false); - curwin->w_cursor.col = c; // For redo we use a change-word command. ResetRedobuff(); @@ -2940,7 +2938,10 @@ void spell_suggest(int count) stp->st_wordlen + sug.su_badlen - stp->st_orglen); AppendCharToRedobuff(ESC); - // After this "p" may be invalid. + // "p" may be freed here + ml_replace(curwin->w_cursor.lnum, p, false); + curwin->w_cursor.col = c; + changed_bytes(curwin->w_cursor.lnum, c); } else curwin->w_cursor = prev_cursor; |