Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
patch 9.0.0221: accessing freed memory if compiling nested function f…
…ails

Problem:    Accessing freed memory if compiling nested function fails.
Solution:   Mess up the variable name so that it won't be found.
  • Loading branch information
brammool committed Aug 16, 2022
1 parent f6d39c3 commit 1889f49
Show file tree
Hide file tree
Showing 3 changed files with 19 additions and 2 deletions.
12 changes: 12 additions & 0 deletions src/testdir/test_vim9_func.vim
Expand Up @@ -911,6 +911,18 @@ def Test_nested_function()
v9.CheckScriptFailure(lines, 'E1173: Text found after enddef: burp', 3)
enddef

def Test_nested_function_fails()
var lines =<< trim END
def T()
def Func(g: string):string
enddef
Func()
enddef
silent! defcompile
END
v9.CheckScriptFailure(lines, 'E1069:')
enddef

def Test_not_nested_function()
echo printf('%d',
function('len')('xxx'))
Expand Down
2 changes: 2 additions & 0 deletions src/version.c
Expand Up @@ -735,6 +735,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
/**/
221,
/**/
220,
/**/
Expand Down
7 changes: 5 additions & 2 deletions src/vim9compile.c
Expand Up @@ -830,6 +830,7 @@ compile_nested_function(exarg_T *eap, cctx_T *cctx, garray_T *lines_to_free)
int r = FAIL;
compiletype_T compile_type;
isn_T *funcref_isn = NULL;
lvar_T *lvar = NULL;

if (eap->forceit)
{
Expand Down Expand Up @@ -936,9 +937,8 @@ compile_nested_function(exarg_T *eap, cctx_T *cctx, garray_T *lines_to_free)
else
{
// Define a local variable for the function reference.
lvar_T *lvar = reserve_local(cctx, func_name, name_end - name_start,
lvar = reserve_local(cctx, func_name, name_end - name_start,
TRUE, ufunc->uf_func_type);

if (lvar == NULL)
goto theend;
if (generate_FUNCREF(cctx, ufunc, &funcref_isn) == FAIL)
Expand All @@ -957,6 +957,9 @@ compile_nested_function(exarg_T *eap, cctx_T *cctx, garray_T *lines_to_free)
&& compile_def_function(ufunc, TRUE, compile_type, cctx) == FAIL)
{
func_ptr_unref(ufunc);
if (lvar != NULL)
// Now the local variable can't be used.
*lvar->lv_name = '/'; // impossible value
goto theend;
}

Expand Down

0 comments on commit 1889f49

Please sign in to comment.