To: vim_dev@googlegroups.com Subject: Patch 7.4.2322 Fcc: outbox From: Bram Moolenaar Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ------------ Patch 7.4.2323 Problem: Using freed memory when using 'formatexpr'. (Dominique Pelle) Solution: Make a copy of 'formatexpr' before evaluating it. Files: src/ops.c, src/testdir/test_normal.vim *** ../vim-7.4.2322/src/ops.c 2016-08-29 22:48:12.157106115 +0200 --- src/ops.c 2016-09-04 14:59:01.533098072 +0200 *************** *** 4741,4746 **** --- 4741,4747 ---- int use_sandbox = was_set_insecurely((char_u *)"formatexpr", OPT_LOCAL); int r; + char_u *fex; /* * Set v:lnum to the first line number and v:count to the number of lines. *************** *** 4750,4765 **** set_vim_var_nr(VV_COUNT, count); set_vim_var_char(c); /* * Evaluate the function. */ if (use_sandbox) ++sandbox; ! r = (int)eval_to_number(curbuf->b_p_fex); if (use_sandbox) --sandbox; set_vim_var_string(VV_CHAR, NULL, -1); return r; } --- 4751,4772 ---- set_vim_var_nr(VV_COUNT, count); set_vim_var_char(c); + /* Make a copy, the option could be changed while calling it. */ + fex = vim_strsave(curbuf->b_p_fex); + if (fex == NULL) + return 0; + /* * Evaluate the function. */ if (use_sandbox) ++sandbox; ! r = (int)eval_to_number(fex); if (use_sandbox) --sandbox; set_vim_var_string(VV_CHAR, NULL, -1); + vim_free(fex); return r; } *** ../vim-7.4.2322/src/testdir/test_normal.vim 2016-09-04 14:34:24.901753228 +0200 --- src/testdir/test_normal.vim 2016-09-04 14:56:52.326221580 +0200 *************** *** 192,197 **** --- 192,221 ---- bw! endfu + func Test_normal05_formatexpr_newbuf() + " Edit another buffer in the 'formatexpr' function + new + func! Format() + edit another + endfunc + set formatexpr=Format() + norm gqG + bw! + set formatexpr= + endfunc + + func Test_normal05_formatexpr_setopt() + " Change the 'formatexpr' value in the function + new + func! Format() + set formatexpr= + endfunc + set formatexpr=Format() + norm gqG + bw! + set formatexpr= + endfunc + func! Test_normal06_formatprg() " basic test for formatprg " only test on non windows platform *** ../vim-7.4.2322/src/version.c 2016-09-04 14:34:24.905753195 +0200 --- src/version.c 2016-09-04 15:11:05.742812720 +0200 *************** *** 765,766 **** --- 765,768 ---- { /* Add new patch number below this line */ + /**/ + 2323, /**/ -- hundred-and-one symptoms of being an internet addict: 162. You go outside and look for a brightness knob to turn down the sun. /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net \\\ /// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\ \\\ an exciting new programming language -- http://www.Zimbu.org /// \\\ help me help AIDS victims -- http://ICCF-Holland.org ///