From ab860cb5f6c749b937e0986167702a36e45000ca Mon Sep 17 00:00:00 2001
From: erw7 <erw7.github@gmail.com>
Date: Mon, 2 Dec 2019 19:09:30 +0900
Subject: dictwatcher: fix use-after-free #11495

fixes #11494
---
 src/nvim/eval/typval.c | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'src')

diff --git a/src/nvim/eval/typval.c b/src/nvim/eval/typval.c
index 106b8f6eed..72ee45a03a 100644
--- a/src/nvim/eval/typval.c
+++ b/src/nvim/eval/typval.c
@@ -1200,6 +1200,7 @@ void tv_dict_watcher_notify(dict_T *const dict, const char *const key,
 
   typval_T rettv;
 
+  dict->dv_refcount++;
   QUEUE *w;
   QUEUE_FOREACH(w, &dict->watchers) {
     DictWatcher *watcher = tv_dict_watcher_node_data(w);
@@ -1211,6 +1212,7 @@ void tv_dict_watcher_notify(dict_T *const dict, const char *const key,
       tv_clear(&rettv);
     }
   }
+  tv_dict_unref(dict);
 
   for (size_t i = 1; i < ARRAY_SIZE(argv); i++) {
     tv_clear(argv + i);
-- 
cgit