diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2022-05-27 05:59:05 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-05-27 05:59:05 +0800 |
| commit | e2940d3c79586503c0a645010ae56c7097ca7c3f (patch) | |
| tree | ed87db1449158ddba128044071356f0ac03ea167 /src | |
| parent | 30915cc8b0e8b92cb83a23833c7a1116e20c055d (diff) | |
| download | rneovim-e2940d3c79586503c0a645010ae56c7097ca7c3f.tar.gz rneovim-e2940d3c79586503c0a645010ae56c7097ca7c3f.tar.bz2 rneovim-e2940d3c79586503c0a645010ae56c7097ca7c3f.zip | |
vim-patch:8.2.5024: using freed memory with "]d" (#18762)
Problem: Using freed memory with "]d".
Solution: Copy the pattern before searching.
https://github.com/vim/vim/commit/e2fa213cf571041dbd04ab0329303ffdc980678a
Diffstat (limited to 'src')
| -rw-r--r-- | src/nvim/normal.c | 3 | ||||
| -rw-r--r-- | src/nvim/testdir/test_tagjump.vim | 6 |
2 files changed, 9 insertions, 0 deletions
diff --git a/src/nvim/normal.c b/src/nvim/normal.c index d806741175..3b91044f41 100644 --- a/src/nvim/normal.c +++ b/src/nvim/normal.c @@ -4826,6 +4826,8 @@ static void nv_brackets(cmdarg_T *cap) if ((len = find_ident_under_cursor(&ptr, FIND_IDENT)) == 0) { clearop(cap->oap); } else { + // Make a copy, if the line was changed it will be freed. + ptr = vim_strnsave(ptr, len); find_pattern_in_path(ptr, 0, len, true, cap->count0 == 0 ? !isupper(cap->nchar) : false, (((cap->nchar & 0xf) == ('d' & 0xf)) @@ -4839,6 +4841,7 @@ static void nv_brackets(cmdarg_T *cap) ? curwin->w_cursor.lnum + 1 : (linenr_T)1), MAXLNUM); + xfree(ptr); curwin->w_set_curswant = true; } } else if ((cap->cmdchar == '[' && vim_strchr("{(*/#mM", cap->nchar) != NULL) diff --git a/src/nvim/testdir/test_tagjump.vim b/src/nvim/testdir/test_tagjump.vim index 2fe3c448d6..11e32067b2 100644 --- a/src/nvim/testdir/test_tagjump.vim +++ b/src/nvim/testdir/test_tagjump.vim @@ -1084,6 +1084,12 @@ func Test_define_search() sil norm o0 sil! norm bwipe! + + new somefile + call setline(1, ['first line', '', '#define something 0']) + sil norm 0o0 + sil! norm ]d + bwipe! endfunc " Test for the 'taglength' option |