From 9ab6fe4fedd5655c6568ace8b853fbfd078107ea Mon Sep 17 00:00:00 2001
From: Jan Edmund Lazo <janedmundlazo@hotmail.com>
Date: Sat, 16 Jun 2018 00:12:50 -0400
Subject: vim-patch:8.0.0575: using freed memory when resetting 'indentexpr'

Problem:    Using freed memory when resetting 'indentexpr' while evaluating
            it. (Dominique Pelle)
Solution:   Make a copy of 'indentexpr'.
https://github.com/vim/vim/commit/a701b3b6f0f06ac0c9fcc75c6c34a1258fc3b1a2
---
 src/nvim/indent.c                 |  9 ++++++++-
 src/nvim/testdir/test_options.vim | 12 ++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

(limited to 'src')

diff --git a/src/nvim/indent.c b/src/nvim/indent.c
index efca739c2d..0d5b82bc5b 100644
--- a/src/nvim/indent.c
+++ b/src/nvim/indent.c
@@ -538,7 +538,14 @@ int get_expr_indent(void)
     sandbox++;
   }
   textlock++;
-  indent = (int)eval_to_number(curbuf->b_p_inde);
+
+  // Need to make a copy, the 'indentexpr' option could be changed while
+  // evaluating it.
+  char_u *inde_copy = vim_strsave(curbuf->b_p_inde);
+  if (inde_copy != NULL) {
+    indent = (int)eval_to_number(inde_copy);
+    xfree(inde_copy);
+  }
 
   if (use_sandbox) {
     sandbox--;
diff --git a/src/nvim/testdir/test_options.vim b/src/nvim/testdir/test_options.vim
index 5ae8528ee9..d9cd5fd583 100644
--- a/src/nvim/testdir/test_options.vim
+++ b/src/nvim/testdir/test_options.vim
@@ -275,3 +275,15 @@ func Test_complete()
   set complete&
 endfun
 
+func ResetIndentexpr()
+  set indentexpr=
+endfunc
+
+func Test_set_indentexpr()
+  " this was causing usage of freed memory
+  set indentexpr=ResetIndentexpr()
+  new
+  call feedkeys("i\<c-f>", 'x')
+  call assert_equal('', &indentexpr)
+  bwipe!
+endfunc
-- 
cgit