diff options
| author | Jurica Bradaric <jbradaric@gmail.com> | 2017-07-17 15:53:23 +0200 |
|---|---|---|
| committer | Jurica Bradaric <jbradaric@gmail.com> | 2017-07-20 12:57:08 +0200 |
| commit | 710546c5e93cd433bd2eb566df52b58e3583c386 (patch) | |
| tree | 9945e93e7ebca2387221b6a11670f100000a0124 /src/nvim/eval.c | |
| parent | c40093f47a32fa4fc885ecae1f2f78cdb30d635d (diff) | |
| download | rneovim-710546c5e93cd433bd2eb566df52b58e3583c386.tar.gz rneovim-710546c5e93cd433bd2eb566df52b58e3583c386.tar.bz2 rneovim-710546c5e93cd433bd2eb566df52b58e3583c386.zip | |
vim-patch:8.0.0085
Problem: Using freed memory with recursive function call. (Dominique Pelle)
Solution: Make a copy of the function name.
https://github.com/vim/vim/commit/8a01f969c198eeb655ad2f96f2796a6f6f4a1924
Diffstat (limited to 'src/nvim/eval.c')
| -rw-r--r-- | src/nvim/eval.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/nvim/eval.c b/src/nvim/eval.c index e5bb7f1b38..08b3d1dbd7 100644 --- a/src/nvim/eval.c +++ b/src/nvim/eval.c @@ -4239,11 +4239,17 @@ static int eval7( // use its contents. s = deref_func_name((const char *)s, &len, &partial, !evaluate); + // Need to make a copy, in case evaluating the arguments makes + // the name invalid. + s = xmemdupz(s, len); + // Invoke the function. ret = get_func_tv(s, len, rettv, arg, curwin->w_cursor.lnum, curwin->w_cursor.lnum, &len, evaluate, partial, NULL); + xfree(s); + // If evaluate is false rettv->v_type was not set in // get_func_tv, but it's needed in handle_subscript() to parse // what follows. So set it here. |