zeertzjq cc25b2f13c vim-patch:9.2.0960: double-free in string_reduce() (#41357) ...

Problem:  string_reduce() copies *rettv into argv[0] before calling
          eval_expr_typval().  When the evaluator fails early, rettv is
          never reset and still aliases argv[0] v_string.
          clear_tv(&argv[0]) frees it, leaving rettv dangling and when
          in vim9script get_func_tv() frees it again (Ave Dva).
Solution: Set rettv->v_type = VAR_UNKNOWN like what is done in
          list_reduce() and tuple_reduce(), use tv_get_string_strict()
          in f_reduce()

closes: vim/vim#21048

Supported by AI.

cd59994c45

Co-authored-by: Christian Brabandt <cb@256bit.org>

2026-08-18 09:03:27 +08:00

..

testdir

vim-patch:9.2.0960: double-free in string_reduce() (#41357)

2026-08-18 09:03:27 +08:00

memfile_test.c

build: remove PVS

2023-11-12 21:26:39 +01:00

runner.lua

build(zig): run oldtests in zig builds with new lua runner

2026-06-02 11:12:11 +02:00