mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2026-08-30 11:02:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.2.0813: dict_add_func() may corrupt funcref count on failure (#40877)

Browse Source 
Problem:  dict_add_func() references the function only after a
          successful dict_add(), on failure dictitem_free()
          calls func_unref() without a matching func_ref(), corrupting
          the reference count of a lambda or numbered function.
Solution: Take the reference before dict_add() so the unref on the
          failure path is balanced (Yasuhiro Matsumoto).

related: vim/vim#20668
closes:  vim/vim#20742

4a403b48c6

Co-authored-by: Yasuhiro Matsumoto <mattn.jp@gmail.com>
This commit is contained in:
zeertzjq
2026-07-21 07:02:08 +08:00
committed by GitHub
parent 60b643a815
commit 32538082ea
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/nvim/eval/typval.c
View File

@@ -2690,11 +2690,12 @@ int tv_dict_add_func(dict_T *const d, const char *const key, const size_t key_le
item->di_tv.v_type = VAR_FUNC;
item->di_tv.vval.v_string = xmemdupz(fp->uf_name, fp->uf_namelen);
// Reference before tv_dict_add() so tv_dict_item_free()'s unref stays balanced on failure.
func_ref(item->di_tv.vval.v_string);
if (tv_dict_add(d, item) == FAIL) {
tv_dict_item_free(item);
return FAIL;
}
func_ref(item->di_tv.vval.v_string);
return OK;
}