To: vim-dev@vim.org Subject: Patch 7.2.297 Fcc: outbox From: Bram Moolenaar Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ------------ Patch 7.2.297 Problem: Reading freed memory when writing ":reg" output to a register. (Dominique Pelle) Solution: Skip the register being written to. Files: src/ops.c *** ../vim-7.2.296/src/ops.c 2009-11-11 17:22:30.000000000 +0100 --- src/ops.c 2009-11-11 19:30:47.000000000 +0100 *************** *** 3991,3996 **** --- 3991,4004 ---- } else yb = &(y_regs[i]); + + #ifdef FEAT_EVAL + if (name == MB_TOLOWER(redir_reg) + || (redir_reg == '"' && yb == y_previous)) + continue; /* do not list register being written to, the + * pointer can be freed */ + #endif + if (yb->y_array != NULL) { msg_putchar('\n'); *************** *** 6090,6096 **** long maxlen; #endif ! if (y_ptr->y_array == NULL) /* NULL means emtpy register */ y_ptr->y_size = 0; /* --- 6098,6104 ---- long maxlen; #endif ! if (y_ptr->y_array == NULL) /* NULL means empty register */ y_ptr->y_size = 0; /* *** ../vim-7.2.296/src/version.c 2009-11-17 12:31:30.000000000 +0100 --- src/version.c 2009-11-17 12:42:28.000000000 +0100 *************** *** 683,684 **** --- 683,686 ---- { /* Add new patch number below this line */ + /**/ + 297, /**/ -- "Beware of bugs in the above code; I have only proved it correct, not tried it." -- Donald Knuth /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net \\\ /// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\ \\\ download, build and distribute -- http://www.A-A-P.org /// \\\ help me help AIDS victims -- http://ICCF-Holland.org ///