From 0f1c6708fdf17bb9c7305b8af5d12189956195b6 Mon Sep 17 00:00:00 2001 From: Bram Moolenaar Date: Sat, 28 Sep 2019 15:24:00 +0200 Subject: [PATCH] patch 8.1.2091: double free when memory allocation fails Problem: Double free when memory allocation fails. (Zu-Ming Jiang) Solution: Use VIM_CLEAR() instead of vim_free(). (closes #4991) --- src/getchar.c | 4 ++-- src/version.c | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/getchar.c b/src/getchar.c index 1056e938ed..fcdc639688 100644 --- a/src/getchar.c +++ b/src/getchar.c @@ -1296,11 +1296,11 @@ free_typebuf(void) if (typebuf.tb_buf == typebuf_init) internal_error("Free typebuf 1"); else - vim_free(typebuf.tb_buf); + VIM_CLEAR(typebuf.tb_buf); if (typebuf.tb_noremap == noremapbuf_init) internal_error("Free typebuf 2"); else - vim_free(typebuf.tb_noremap); + VIM_CLEAR(typebuf.tb_noremap); } /* diff --git a/src/version.c b/src/version.c index e595c7ab6e..2d9ffa3577 100644 --- a/src/version.c +++ b/src/version.c @@ -757,6 +757,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 2091, /**/ 2090, /**/