aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorzeertzjq <zeertzjq@outlook.com>2025-02-03 10:49:06 +0800
committerzeertzjq <zeertzjq@outlook.com>2025-02-03 11:27:56 +0800
commitdb7db783a2d634d5589ebe12605e3989cb30650c (patch)
treea0209d4333807a8edd4b8dde2eaf37364756c9e9 /src
parent82ac8294c22a15899548a1cb408ca114a598f434 (diff)
downloadrneovim-db7db783a2d634d5589ebe12605e3989cb30650c.tar.gz
rneovim-db7db783a2d634d5589ebe12605e3989cb30650c.tar.bz2
rneovim-db7db783a2d634d5589ebe12605e3989cb30650c.zip
vim-patch:9.1.1071: args missing after failing to redefine a function
Problem: Arguments of a function are missing after failing to redefine it (after 8.2.2505), and heap-use-after-free with script-local function (after 9.1.1063). Solution: Don't clear arguments or free uf_name_exp when failing to redefine an existing function (zeertzjq) closes: vim/vim#16567 https://github.com/vim/vim/commit/04d2a3fdc051d6a419dc0ea4de7a9640cefccd31
Diffstat (limited to 'src')
-rw-r--r--src/nvim/eval/userfunc.c11
1 files changed, 6 insertions, 5 deletions
diff --git a/src/nvim/eval/userfunc.c b/src/nvim/eval/userfunc.c
index 402798cafa..8022b37f6b 100644
--- a/src/nvim/eval/userfunc.c
+++ b/src/nvim/eval/userfunc.c
@@ -2825,11 +2825,11 @@ void ex_function(exarg_T *eap)
&& (fp->uf_script_ctx.sc_sid != current_sctx.sc_sid
|| fp->uf_script_ctx.sc_seq == current_sctx.sc_seq)) {
emsg_funcname(e_funcexts, name);
- goto erret;
+ goto errret_keep;
}
if (fp->uf_calls > 0) {
emsg_funcname(N_("E127: Cannot redefine function %s: It is in use"), name);
- goto erret;
+ goto errret_keep;
}
if (fp->uf_refcount > 1) {
// This function is referenced somewhere, don't redefine it but
@@ -2961,9 +2961,6 @@ erret:
ga_init(&fp->uf_def_args, (int)sizeof(char *), 1);
}
errret_2:
- ga_clear_strings(&newargs);
- ga_clear_strings(&default_args);
- ga_clear_strings(&newlines);
if (fp != NULL) {
XFREE_CLEAR(fp->uf_name_exp);
}
@@ -2971,6 +2968,10 @@ errret_2:
xfree(fp);
fp = NULL;
}
+errret_keep:
+ ga_clear_strings(&newargs);
+ ga_clear_strings(&default_args);
+ ga_clear_strings(&newlines);
ret_free:
xfree(line_to_free);
xfree(fudi.fd_newkey);