diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2026-08-18 09:03:27 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-08-18 09:03:27 +0800 |
| commit | cc25b2f13cff2b743cefbc09c7330e28d10bc289 (patch) | |
| tree | 254484dfa9776cb246184307ad999a5b8e4c5418 /runtime/lua/vim/range.lua | |
| parent | b107154ba243c12c076a5996058c606b276de251 (diff) | |
| download | rneovim-cc25b2f13cff2b743cefbc09c7330e28d10bc289.tar.gz rneovim-cc25b2f13cff2b743cefbc09c7330e28d10bc289.tar.bz2 rneovim-cc25b2f13cff2b743cefbc09c7330e28d10bc289.zip | |
vim-patch:9.2.0960: double-free in string_reduce() (#41357)
Problem: string_reduce() copies *rettv into argv[0] before calling
eval_expr_typval(). When the evaluator fails early, rettv is
never reset and still aliases argv[0] v_string.
clear_tv(&argv[0]) frees it, leaving rettv dangling and when
in vim9script get_func_tv() frees it again (Ave Dva).
Solution: Set rettv->v_type = VAR_UNKNOWN like what is done in
list_reduce() and tuple_reduce(), use tv_get_string_strict()
in f_reduce()
closes: vim/vim#21048
Supported by AI.
https://github.com/vim/vim/commit/cd59994c455a20d39d5cc41b4978ecfd2bf4be2e
Co-authored-by: Christian Brabandt <cb@256bit.org>
Diffstat (limited to 'runtime/lua/vim/range.lua')
0 files changed, 0 insertions, 0 deletions