diff options
| author | oni-link <knil.ino@gmail.com> | 2014-12-15 20:06:54 +0100 |
|---|---|---|
| committer | oni-link <knil.ino@gmail.com> | 2014-12-15 20:11:18 +0100 |
| commit | bf4b85a5d44ec9c985f029ad8d8b1f6c59d1ea39 (patch) | |
| tree | 5945792378727f9b6ef7af97b9a24588302be16b /src | |
| parent | c63b736921d143354e3a7a607deafdb72c0ae8f9 (diff) | |
| download | rneovim-bf4b85a5d44ec9c985f029ad8d8b1f6c59d1ea39.tar.gz rneovim-bf4b85a5d44ec9c985f029ad8d8b1f6c59d1ea39.tar.bz2 rneovim-bf4b85a5d44ec9c985f029ad8d8b1f6c59d1ea39.zip | |
Fix warning: ops.c: read_viminfo_register(): Dereference of null pointer: RI.
Problem : Array access (via field 'y_array') results in a null pointer
dereference @ 4487.
Diagnostic : Real issue.
Rationale : If the array was previously freed and the size of the array
(y_current->y_size) was not updated to zero, the loop @4486
could be entered and a NULL pointer would be dereferenced.
Resolution : Use free_yank_all() to take care of the NULL check and
to free the current yank register.
Diffstat (limited to 'src')
| -rw-r--r-- | src/nvim/ops.c | 6 |
1 files changed, 1 insertions, 5 deletions
diff --git a/src/nvim/ops.c b/src/nvim/ops.c index 9f73d40761..a6dee2be5b 100644 --- a/src/nvim/ops.c +++ b/src/nvim/ops.c @@ -4483,10 +4483,7 @@ int read_viminfo_register(vir_T *virp, int force) if (set_prev) y_previous = y_current; - for (int i = 0; i < y_current->y_size; i++) { - free(y_current->y_array[i]); - } - free(y_current->y_array); + free_yank_all(); array = xmalloc(limit * sizeof(char_u *)); str = skipwhite(skiptowhite(str)); @@ -4515,7 +4512,6 @@ int read_viminfo_register(vir_T *virp, int force) if (do_it) { if (size == 0) { free(array); - y_current->y_array = NULL; } else if (size < limit) { y_current->y_array = xrealloc(array, size * sizeof(char_u *)); } else { |