summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorBram Moolenaar <Bram@vim.org>2017-04-20 22:57:27 +0200
committerBram Moolenaar <Bram@vim.org>2017-04-20 22:57:27 +0200
commita701b3b6f0f06ac0c9fcc75c6c34a1258fc3b1a2 (patch)
tree23d623833093529287f373c9428ebad70ddb6835
parent99895eac1cf71be43ece7e14b50e206e041fbe9f (diff)
patch 8.0.0575: using freed memory when resetting 'indentexpr'v8.0.0575
Problem: Using freed memory when resetting 'indentexpr' while evaluating it. (Dominique Pelle) Solution: Make a copy of 'indentexpr'.
-rw-r--r--src/misc1.c12
-rw-r--r--src/testdir/test_options.vim13
-rw-r--r--src/version.c2
3 files changed, 26 insertions, 1 deletions
diff --git a/src/misc1.c b/src/misc1.c
index 951467d94c..1a220e1eb5 100644
--- a/src/misc1.c
+++ b/src/misc1.c
@@ -9252,6 +9252,7 @@ find_match(int lookfor, linenr_T ourscope)
get_expr_indent(void)
{
int indent;
+ char_u *inde_copy;
pos_T save_pos;
colnr_T save_curswant;
int save_set_curswant;
@@ -9268,7 +9269,16 @@ get_expr_indent(void)
if (use_sandbox)
++sandbox;
++textlock;
- indent = (int)eval_to_number(curbuf->b_p_inde);
+
+ /* Need to make a copy, the 'indentexpr' option could be changed while
+ * evaluating it. */
+ inde_copy = vim_strsave(curbuf->b_p_inde);
+ if (inde_copy != NULL)
+ {
+ indent = (int)eval_to_number(inde_copy);
+ vim_free(inde_copy);
+ }
+
if (use_sandbox)
--sandbox;
--textlock;
diff --git a/src/testdir/test_options.vim b/src/testdir/test_options.vim
index d72ca74b29..5d2033a5df 100644
--- a/src/testdir/test_options.vim
+++ b/src/testdir/test_options.vim
@@ -319,3 +319,16 @@ func Test_set_values()
throw 'Skipped: opt_test.vim does not exist'
endif
endfunc
+
+func ResetIndentexpr()
+ set indentexpr=
+endfunc
+
+func Test_set_indentexpr()
+ " this was causing usage of freed memory
+ set indentexpr=ResetIndentexpr()
+ new
+ call feedkeys("i\<c-f>", 'x')
+ call assert_equal('', &indentexpr)
+ bwipe!
+endfunc
diff --git a/src/version.c b/src/version.c
index 28fe0b7e82..60dbdf4188 100644
--- a/src/version.c
+++ b/src/version.c
@@ -765,6 +765,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 575,
+/**/
574,
/**/
573,