From c76dfe14b1422a1caccf13c3bc86754902eb0302 Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Fri, 24 Feb 2023 15:33:51 +0800 Subject: [PATCH] vim-patch:8.2.4632: using freed memory in flatten() Problem: Using freed memory in flatten(). Solution: Clear typval after recursing into list. https://github.com/vim/vim/commit/f3980dc5d0a5f873cf764b8ba3e567e42259e4e5 Co-authored-by: Bram Moolenaar --- src/nvim/eval/typval.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/nvim/eval/typval.c b/src/nvim/eval/typval.c index 9faf19c364..17499480ed 100644 --- a/src/nvim/eval/typval.c +++ b/src/nvim/eval/typval.c @@ -682,13 +682,13 @@ void tv_list_flatten(list_T *list, listitem_T *first, long maxitems, long maxdep tv_list_drop_items(list, item, item); tv_list_extend(list, itemlist, next); - tv_clear(&item->li_tv); if (maxdepth > 0) { tv_list_flatten(list, item->li_prev == NULL ? list->lv_first : item->li_prev->li_next, itemlist->lv_len, maxdepth - 1); } + tv_clear(&item->li_tv); xfree(item); }