diff options
| author | James McCoy <jamessan@jamessan.com> | 2017-01-12 13:57:37 -0500 |
|---|---|---|
| committer | James McCoy <jamessan@jamessan.com> | 2017-01-12 14:47:43 -0500 |
| commit | 674db4b01fc6b899c7f56a40b77fa40c32466f6c (patch) | |
| tree | 99084f57c9836176a133ca4d47aa7f26ce7fc907 /src/nvim/eval.c | |
| parent | 50d0d891299c111c5e349c084ef146facfaad009 (diff) | |
| download | rneovim-674db4b01fc6b899c7f56a40b77fa40c32466f6c.tar.gz rneovim-674db4b01fc6b899c7f56a40b77fa40c32466f6c.tar.bz2 rneovim-674db4b01fc6b899c7f56a40b77fa40c32466f6c.zip | |
eval: Remove dictwatcher from watchers queue before freeing it
This fixes a use-after-free noticed by ASAN which would occur when a
dictwatcher was still active on a dictionary when the dictionary was
freed.
fun! MakeWatch()
let d = {'foo': 'bar'}
call dictwatcheradd(d, 'foo', function('...'))
endfun
Patch-by: oni-link
Closes #5930
Diffstat (limited to 'src/nvim/eval.c')
| -rw-r--r-- | src/nvim/eval.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/nvim/eval.c b/src/nvim/eval.c index 1688a565c1..cdf60d9765 100644 --- a/src/nvim/eval.c +++ b/src/nvim/eval.c @@ -6410,8 +6410,8 @@ static void dict_free_contents(dict_T *d) { while (!QUEUE_EMPTY(&d->watchers)) { QUEUE *w = QUEUE_HEAD(&d->watchers); DictWatcher *watcher = dictwatcher_node_data(w); - dictwatcher_free(watcher); QUEUE_REMOVE(w); + dictwatcher_free(watcher); } hash_clear(&d->dv_hashtab); |