IntenseFinance/neovim
3
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-02-25 18:55:25 -06:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:9.0.0246: using freed memory when 'tagfunc' deletes the buffer

Browse Source 
Problem:    Using freed memory when 'tagfunc' deletes the buffer.
Solution:   Make a copy of the tag name.

adce965162

Co-authored-by: Bram Moolenaar <Bram@vim.org>
This commit is contained in:
zeertzjq 2022-11-05 16:59:07 +08:00
parent 1e4adf4b56
commit 595f7f37a9
2 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/nvim/tag.c
View File

@ -199,6 +199,7 @@ void do_tag(char *tag, int type, int count, int forceit, int verbose)
int skip_msg = false; int skip_msg = false;
char_u *buf_ffname = (char_u *)curbuf->b_ffname; // name for priority computation char_u *buf_ffname = (char_u *)curbuf->b_ffname; // name for priority computation
int use_tfu = 1; int use_tfu = 1;
char *tofree = NULL;
// remember the matches for the last used tag // remember the matches for the last used tag
static int num_matches = 0; static int num_matches = 0;
@ -450,7 +451,10 @@ void do_tag(char *tag, int type, int count, int forceit, int verbose)
// When desired match not found yet, try to find it (and others). // When desired match not found yet, try to find it (and others).
if (use_tagstack) { if (use_tagstack) {
name = tagstack[tagstackidx].tagname; // make a copy, the tagstack may change in 'tagfunc'
name = xstrdup(tagstack[tagstackidx].tagname);
xfree(tofree);
tofree = name;
} else if (g_do_tagpreview != 0) { } else if (g_do_tagpreview != 0) {
name = ptag_entry.tagname; name = ptag_entry.tagname;
} else { } else {
@ -681,6 +685,7 @@ end_do_tag:
} }
postponed_split = 0; // don't split next time postponed_split = 0; // don't split next time
g_do_tagpreview = 0; // don't do tag preview next time g_do_tagpreview = 0; // don't do tag preview next time
xfree(tofree);
} }
// List all the matching tags. // List all the matching tags.

12
src/nvim/testdir/test_tagfunc.vim
View File

@ -273,4 +273,16 @@ func Test_tagfunc_callback()
%bw! %bw!
endfunc endfunc
func Test_tagfunc_wipes_buffer()
func g:Tag0unc0(t,f,o)
bwipe
endfunc
set tagfunc=g:Tag0unc0
new
cal assert_fails('tag 0', 'E987:')
delfunc g:Tag0unc0
set tagfunc=
endfunc
" vim: shiftwidth=2 sts=2 expandtab " vim: shiftwidth=2 sts=2 expandtab