From 47d9a393de766d8e444043f5bc40dc774d45fece Mon Sep 17 00:00:00 2001 From: James McCoy Date: Sun, 22 May 2022 13:29:15 -0400 Subject: fix(cid/352839): USE_AFTER_FREE in create_user_command #18669 --- src/nvim/api/private/helpers.c | 2 +- src/nvim/ex_docmd.c | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/nvim/api/private/helpers.c b/src/nvim/api/private/helpers.c index 5d4b84482b..adabb1471e 100644 --- a/src/nvim/api/private/helpers.c +++ b/src/nvim/api/private/helpers.c @@ -1616,7 +1616,7 @@ void create_user_command(String name, Object command, Dict(user_command) *opts, if (uc_add_command(name.data, name.size, rep, argt, def, flags, compl, compl_arg, compl_luaref, addr_type_arg, luaref, force) != OK) { api_set_error(err, kErrorTypeException, "Failed to create user command"); - goto err; + // Do not goto err, since uc_add_command now owns luaref, compl_luaref, and compl_arg } return; diff --git a/src/nvim/ex_docmd.c b/src/nvim/ex_docmd.c index 5f9d73a25a..6d1e1c073b 100644 --- a/src/nvim/ex_docmd.c +++ b/src/nvim/ex_docmd.c @@ -5528,6 +5528,11 @@ char *uc_validate_name(char *name) return name; } +/// Create a new user command {name}, if one doesn't already exist. +/// +/// This function takes ownership of compl_arg, compl_luaref, and luaref. +/// +/// @return OK if the command is created, FAIL otherwise. int uc_add_command(char *name, size_t name_len, char *rep, uint32_t argt, long def, int flags, int compl, char *compl_arg, LuaRef compl_luaref, cmd_addr_T addr_type, LuaRef luaref, bool force) -- cgit