mirror of
https://github.com/neovim/neovim.git
synced 2025-10-09 19:36:40 +00:00

If a conversion for a container fails in object_to_vim(), the memory for the container in the returned/converted value is freed, but the returned value keeps a pointer to the freed memory. Calling later clear_tv() on this value leads to an invalid memory access. Set v_type to VAR_UNKNOWN in the converted value on failure, so that clear_tv() has no effect.