diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2024-09-21 18:26:44 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-09-21 18:26:44 +0800 |
| commit | d8cd15e8d67d76a327b5ffa75d54a23dc05b58c9 (patch) | |
| tree | aef872b56f1e9021e7ba5396d10886490f12d63d | |
| parent | 059a9e62547e1fb4dc915da258b24844a6bfcd54 (diff) | |
| download | rneovim-d8cd15e8d67d76a327b5ffa75d54a23dc05b58c9.tar.gz rneovim-d8cd15e8d67d76a327b5ffa75d54a23dc05b58c9.tar.bz2 rneovim-d8cd15e8d67d76a327b5ffa75d54a23dc05b58c9.zip | |
vim-patch:9.1.0739: [security]: use-after-free in ex_getln.c (#30448)
Problem: [security]: use-after-free in ex_getln.c
Solution: free pointer p a bit later (John Marriott)
closes: vim/vim#15712
https://github.com/vim/vim/commit/a6de28755ec3fcc86d1ed0b744f1b410a8e9702d
Co-authored-by: John Marriott <basilisk@internode.on.net>
| -rw-r--r-- | src/nvim/ex_getln.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/nvim/ex_getln.c b/src/nvim/ex_getln.c index 722a857f03..6a57b3ab78 100644 --- a/src/nvim/ex_getln.c +++ b/src/nvim/ex_getln.c @@ -3028,7 +3028,6 @@ void realloc_cmdbuff(int len) // there, thus copy up to the NUL and add a NUL. memmove(ccline.cmdbuff, p, (size_t)ccline.cmdlen); ccline.cmdbuff[ccline.cmdlen] = NUL; - xfree(p); if (ccline.xpc != NULL && ccline.xpc->xp_pattern != NULL @@ -3042,6 +3041,8 @@ void realloc_cmdbuff(int len) ccline.xpc->xp_pattern = ccline.cmdbuff + i; } } + + xfree(p); } enum { MAX_CB_ERRORS = 1, }; |