From 39f16a0fee3c13f587f80db51346d8e3785783ce Mon Sep 17 00:00:00 2001
From: "Justin M. Keyes" <justinkz@gmail.com>
Date: Sat, 19 May 2018 12:24:54 +0200
Subject: vim-patch:8.0.0342: double free with EXITFREE and setting 'ttytype'

Problem:    Double free when compiled with EXITFREE and setting 'ttytype'.
Solution:   Avoid setting P_ALLOCED on 'ttytype'. (Dominique Pelle,
            closes vim/vim#1461)
https://github.com/vim/vim/commit/673911457d6745b6b779eb769c2f41965592d12c
---
 src/nvim/option.c                 | 23 ++++++++++-------------
 src/nvim/testdir/test_options.vim | 20 ++++++++++++++++++++
 2 files changed, 30 insertions(+), 13 deletions(-)

(limited to 'src')

diff --git a/src/nvim/option.c b/src/nvim/option.c
index 48c874196d..88c458b597 100644
--- a/src/nvim/option.c
+++ b/src/nvim/option.c
@@ -913,27 +913,24 @@ void set_number_default(char *name, long val)
 }
 
 #if defined(EXITFREE)
-/*
- * Free all options.
- */
+/// Free all options.
 void free_all_options(void)
 {
-  int i;
-
-  for (i = 0; options[i].fullname; i++) {
+  for (int i = 0; options[i].fullname; i++) {
     if (options[i].indir == PV_NONE) {
-      /* global option: free value and default value. */
-      if (options[i].flags & P_ALLOCED && options[i].var != NULL)
+      // global option: free value and default value.
+      if ((options[i].flags & P_ALLOCED) && options[i].var != NULL) {
         free_string_option(*(char_u **)options[i].var);
-      if (options[i].flags & P_DEF_ALLOCED)
+      }
+      if (options[i].flags & P_DEF_ALLOCED) {
         free_string_option(options[i].def_val[VI_DEFAULT]);
-    } else if (options[i].var != VAR_WIN
-               && (options[i].flags & P_STRING))
-      /* buffer-local option: free global value */
+      }
+    } else if (options[i].var != VAR_WIN && (options[i].flags & P_STRING)) {
+      // buffer-local option: free global value
       free_string_option(*(char_u **)options[i].var);
+    }
   }
 }
-
 #endif
 
 
diff --git a/src/nvim/testdir/test_options.vim b/src/nvim/testdir/test_options.vim
index f8c3161b40..738c703b7f 100644
--- a/src/nvim/testdir/test_options.vim
+++ b/src/nvim/testdir/test_options.vim
@@ -227,6 +227,26 @@ func Test_set_errors()
   call assert_fails('set t_foo=', 'E846:')
 endfunc
 
+func Test_set_ttytype()
+  " Nvim does not support 'ttytype'.
+  if !has('nvim') && !has('gui_running') && has('unix')
+    " Setting 'ttytype' used to cause a double-free when exiting vim and
+    " when vim is compiled with -DEXITFREE.
+    set ttytype=ansi
+    call assert_equal('ansi', &ttytype)
+    call assert_equal(&ttytype, &term)
+    set ttytype=xterm
+    call assert_equal('xterm', &ttytype)
+    call assert_equal(&ttytype, &term)
+    " FIXME: "set ttytype=" gives E522 instead of E529
+    " in travis on some builds. Why? Commented out this test for now.
+    " call assert_fails('set ttytype=', 'E529:')
+    call assert_fails('set ttytype=xxx', 'E522:')
+    set ttytype&
+    call assert_equal(&ttytype, &term)
+  endif
+endfunc
+
 func Test_complete()
   " Trailing single backslash used to cause invalid memory access.
   set complete=s\
-- 
cgit