mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-09-06 03:18:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.2.2505: Vim9: crash after defining function with invalid return type

Browse Source 
Problem:    Vim9: crash after defining function with invalid return type.
Solution:   Clear function growarrays.  Fix memory leak.

31842cd077

Cherry-pick free_fp from patch 8.2.3812.

Co-authored-by: Bram Moolenaar <Bram@vim.org>
This commit is contained in:
zeertzjq
2025-02-03 10:21:57 +08:00
parent cd42740245
commit 638c6b406b
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/nvim/eval/userfunc.c
View File

@@ -2515,7 +2515,8 @@ void ex_function(exarg_T *eap)
garray_T newlines; garray_T newlines;
int varargs = false; int varargs = false;
int flags = 0; int flags = 0;
ufunc_T *fp; ufunc_T *fp = NULL;
bool free_fp = false;
bool overwrite = false; bool overwrite = false;
funcdict_T fudi; funcdict_T fudi;
static int func_nr = 0; // number for nameless function static int func_nr = 0; // number for nameless function
@@ -2888,8 +2889,7 @@ void ex_function(exarg_T *eap)
hashitem_T *hi = hash_find(&func_hashtab, name); hashitem_T *hi = hash_find(&func_hashtab, name);
hi->hi_key = UF2HIKEY(fp); hi->hi_key = UF2HIKEY(fp);
} else if (hash_add(&func_hashtab, UF2HIKEY(fp)) == FAIL) { } else if (hash_add(&func_hashtab, UF2HIKEY(fp)) == FAIL) {
xfree(fp); free_fp = true;
fp = NULL;
goto erret; goto erret;
} }
fp->uf_refcount = 1; fp->uf_refcount = 1;
@@ -2920,8 +2920,16 @@ void ex_function(exarg_T *eap)
erret: erret:
ga_clear_strings(&newargs); ga_clear_strings(&newargs);
ga_clear_strings(&default_args); ga_clear_strings(&default_args);
if (fp != NULL) {
ga_init(&fp->uf_args, (int)sizeof(char *), 1);
ga_init(&fp->uf_def_args, (int)sizeof(char *), 1);
}
errret_2: errret_2:
ga_clear_strings(&newlines); ga_clear_strings(&newlines);
if (free_fp) {
xfree(fp);
fp = NULL;
}
ret_free: ret_free:
xfree(line_to_free); xfree(line_to_free);
xfree(fudi.fd_newkey); xfree(fudi.fd_newkey);