From 9be24110f68abc111c87c88d82f50f64a1d3ecdd Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Sat, 24 Dec 2022 16:32:50 +0800 Subject: vim-patch:8.2.4139: using freed memory in expression abbreviation (#21522) Problem: Using freed memory if an expression abbreviation deletes the abbreviation. Solution: Do not access the pointer after evaluating the expression. https://github.com/vim/vim/commit/94075b2b0e8e3b75334799d2c082497fbf85ffa1 Co-authored-by: Bram Moolenaar --- src/nvim/getchar.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'src/nvim/getchar.c') diff --git a/src/nvim/getchar.c b/src/nvim/getchar.c index db4d640f46..b0dac7aea6 100644 --- a/src/nvim/getchar.c +++ b/src/nvim/getchar.c @@ -2191,12 +2191,12 @@ static int handle_mapping(int *keylenp, const bool *timedout, int *mapdepth) // Copy the values from *mp that are used, because evaluating the // expression may invoke a function that redefines the mapping, thereby // making *mp invalid. - char save_m_expr = mp->m_expr; - int save_m_noremap = mp->m_noremap; - char save_m_silent = mp->m_silent; + const bool save_m_expr = mp->m_expr; + const int save_m_noremap = mp->m_noremap; + const bool save_m_silent = mp->m_silent; char *save_m_keys = NULL; // only saved when needed char *save_m_str = NULL; // only saved when needed - LuaRef save_m_luaref = mp->m_luaref; + const LuaRef save_m_luaref = mp->m_luaref; // Handle ":map ": evaluate the {rhs} as an // expression. Also save and restore the command line -- cgit