diff options
| author | Bram Moolenaar <Bram@vim.org> | 2020-12-24 18:39:02 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2020-12-24 18:39:02 +0100 |
| commit | 38455a921395a56690790c8c1d28c1c43ca04c8a (patch) | |
| tree | d762d33f56f9375c80a61b1072382138e287413f /src/popupmenu.c | |
| parent | 0261a1aeeb4ccec4ef75cc8e0685c78f5622dbf5 (diff) | |
patch 8.2.2207: illegal memory access if popup menu items are changedv8.2.2207
Problem: Illegal memory access if popup menu items are changed while the
menu is visible. (Tomáš Janoušek)
Solution: Make a copy of the text. (closes #7537)
Diffstat (limited to 'src/popupmenu.c')
| -rw-r--r-- | src/popupmenu.c | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/src/popupmenu.c b/src/popupmenu.c index c8d305cbcb..1f98408040 100644 --- a/src/popupmenu.c +++ b/src/popupmenu.c @@ -1458,10 +1458,21 @@ pum_show_popupmenu(vimmenu_T *menu) return; FOR_ALL_CHILD_MENUS(menu, mp) + { + char_u *s = NULL; + + // Make a copy of the text, the menu may be redefined in a callback. if (menu_is_separator(mp->dname)) - array[idx++].pum_text = (char_u *)""; + s = (char_u *)""; else if (mp->modes & mp->enabled & mode) - array[idx++].pum_text = mp->dname; + s = mp->dname; + if (s != NULL) + { + s = vim_strsave(s); + if (s != NULL) + array[idx++].pum_text = s; + } + } pum_array = array; pum_compute_size(); @@ -1542,6 +1553,8 @@ pum_show_popupmenu(vimmenu_T *menu) } } + for (idx = 0; idx < pum_size; ++idx) + vim_free(array[idx].pum_text); vim_free(array); pum_undisplay(); # ifdef FEAT_BEVAL_TERM |