From a701b3b6f0f06ac0c9fcc75c6c34a1258fc3b1a2 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Thu, 20 Apr 2017 22:57:27 +0200
Subject: [PATCH] patch 8.0.0575: using freed memory when resetting
 'indentexpr'

Problem:    Using freed memory when resetting 'indentexpr' while evaluating
            it. (Dominique Pelle)
Solution:   Make a copy of 'indentexpr'.
---
 src/misc1.c                  | 12 +++++++++++-
 src/testdir/test_options.vim | 13 +++++++++++++
 src/version.c                |  2 ++
 3 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/src/misc1.c b/src/misc1.c
index 951467d94c..1a220e1eb5 100644
--- a/src/misc1.c
+++ b/src/misc1.c
@@ -9252,6 +9252,7 @@ find_match(int lookfor, linenr_T ourscope)
 get_expr_indent(void)
 {
     int		indent;
+    char_u	*inde_copy;
     pos_T	save_pos;
     colnr_T	save_curswant;
     int		save_set_curswant;
@@ -9268,7 +9269,16 @@ get_expr_indent(void)
     if (use_sandbox)
 	++sandbox;
     ++textlock;
-    indent = (int)eval_to_number(curbuf->b_p_inde);
+
+    /* Need to make a copy, the 'indentexpr' option could be changed while
+     * evaluating it. */
+    inde_copy = vim_strsave(curbuf->b_p_inde);
+    if (inde_copy != NULL)
+    {
+	indent = (int)eval_to_number(inde_copy);
+	vim_free(inde_copy);
+    }
+
     if (use_sandbox)
 	--sandbox;
     --textlock;
diff --git a/src/testdir/test_options.vim b/src/testdir/test_options.vim
index d72ca74b29..5d2033a5df 100644
--- a/src/testdir/test_options.vim
+++ b/src/testdir/test_options.vim
@@ -319,3 +319,16 @@ func Test_set_values()
     throw 'Skipped: opt_test.vim does not exist'
   endif
 endfunc
+
+func ResetIndentexpr()
+  set indentexpr=
+endfunc
+
+func Test_set_indentexpr()
+  " this was causing usage of freed memory
+  set indentexpr=ResetIndentexpr()
+  new
+  call feedkeys("i\<c-f>", 'x')
+  call assert_equal('', &indentexpr)
+  bwipe!
+endfunc
diff --git a/src/version.c b/src/version.c
index 28fe0b7e82..60dbdf4188 100644
--- a/src/version.c
+++ b/src/version.c
@@ -764,6 +764,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    575,
 /**/
     574,
 /**/