patch 9.0.0221: accessing freed memory if compiling nested function fails

Problem:    Accessing freed memory if compiling nested function fails.
Solution:   Mess up the variable name so that it won't be found.
This commit is contained in:
Bram Moolenaar
2022-08-16 19:34:44 +01:00
parent f6d39c31d2
commit 1889f499a4
3 changed files with 19 additions and 2 deletions

View File

@ -911,6 +911,18 @@ def Test_nested_function()
v9.CheckScriptFailure(lines, 'E1173: Text found after enddef: burp', 3)
enddef
def Test_nested_function_fails()
var lines =<< trim END
def T()
def Func(g: string):string
enddef
Func()
enddef
silent! defcompile
END
v9.CheckScriptFailure(lines, 'E1069:')
enddef
def Test_not_nested_function()
echo printf('%d',
function('len')('xxx'))

View File

@ -735,6 +735,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
221,
/**/
220,
/**/

View File

@ -830,6 +830,7 @@ compile_nested_function(exarg_T *eap, cctx_T *cctx, garray_T *lines_to_free)
int r = FAIL;
compiletype_T compile_type;
isn_T *funcref_isn = NULL;
lvar_T *lvar = NULL;
if (eap->forceit)
{
@ -936,9 +937,8 @@ compile_nested_function(exarg_T *eap, cctx_T *cctx, garray_T *lines_to_free)
else
{
// Define a local variable for the function reference.
lvar_T *lvar = reserve_local(cctx, func_name, name_end - name_start,
lvar = reserve_local(cctx, func_name, name_end - name_start,
TRUE, ufunc->uf_func_type);
if (lvar == NULL)
goto theend;
if (generate_FUNCREF(cctx, ufunc, &funcref_isn) == FAIL)
@ -957,6 +957,9 @@ compile_nested_function(exarg_T *eap, cctx_T *cctx, garray_T *lines_to_free)
&& compile_def_function(ufunc, TRUE, compile_type, cctx) == FAIL)
{
func_ptr_unref(ufunc);
if (lvar != NULL)
// Now the local variable can't be used.
*lvar->lv_name = '/'; // impossible value
goto theend;
}