IntenseFinance/neovim
3
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-02-25 18:55:25 -06:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.2.1095: may use pointer after freeing it

Browse Source 
Problem:    May use pointer after freeing it when text properties are used.
Solution:   Update redo buffer before calling ml_replace().
6b949615ed
This commit is contained in:
Jan Edmund Lazo 2020-06-30 00:11:18 -04:00
parent f01bb307fd
commit e84c075ad9
No known key found for this signature in database
GPG Key ID: 64915E6E9F735B15
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/nvim/spell.c
View File

@ -2930,8 +2930,6 @@ void spell_suggest(int count)
memmove(p, line, c); memmove(p, line, c);
STRCPY(p + c, stp->st_word); STRCPY(p + c, stp->st_word);
STRCAT(p, sug.su_badptr + stp->st_orglen); STRCAT(p, sug.su_badptr + stp->st_orglen);
ml_replace(curwin->w_cursor.lnum, p, false);
curwin->w_cursor.col = c;
// For redo we use a change-word command. // For redo we use a change-word command.
ResetRedobuff(); ResetRedobuff();
@ -2940,7 +2938,10 @@ void spell_suggest(int count)
stp->st_wordlen + sug.su_badlen - stp->st_orglen); stp->st_wordlen + sug.su_badlen - stp->st_orglen);
AppendCharToRedobuff(ESC); AppendCharToRedobuff(ESC);
// After this "p" may be invalid. // "p" may be freed here
ml_replace(curwin->w_cursor.lnum, p, false);
curwin->w_cursor.col = c;
changed_bytes(curwin->w_cursor.lnum, c); changed_bytes(curwin->w_cursor.lnum, c);
} else } else
curwin->w_cursor = prev_cursor; curwin->w_cursor = prev_cursor;