Permalink
Browse files

patch 7.4.2323

Problem:    Using freed memory when using 'formatexpr'. (Dominique Pelle)
Solution:   Make a copy of 'formatexpr' before evaluating it.
  • Loading branch information...
1 parent bc54f3f commit d77f9d595eb5f301b39b4373f2900a13c0ca30e2 @brammool brammool committed Sep 4, 2016
Showing with 34 additions and 1 deletion.
  1. +8 −1 src/ops.c
  2. +24 −0 src/testdir/test_normal.vim
  3. +2 −0 src/version.c
View
@@ -4741,6 +4741,7 @@ fex_format(
int use_sandbox = was_set_insecurely((char_u *)"formatexpr",
OPT_LOCAL);
int r;
+ char_u *fex;
/*
* Set v:lnum to the first line number and v:count to the number of lines.
@@ -4750,16 +4751,22 @@ fex_format(
set_vim_var_nr(VV_COUNT, count);
set_vim_var_char(c);
+ /* Make a copy, the option could be changed while calling it. */
+ fex = vim_strsave(curbuf->b_p_fex);
+ if (fex == NULL)
+ return 0;
+
/*
* Evaluate the function.
*/
if (use_sandbox)
++sandbox;
- r = (int)eval_to_number(curbuf->b_p_fex);
+ r = (int)eval_to_number(fex);
if (use_sandbox)
--sandbox;
set_vim_var_string(VV_CHAR, NULL, -1);
+ vim_free(fex);
return r;
}
@@ -192,6 +192,30 @@ func! Test_normal05_formatexpr()
bw!
endfu
+func Test_normal05_formatexpr_newbuf()
+ " Edit another buffer in the 'formatexpr' function
+ new
+ func! Format()
+ edit another
+ endfunc
+ set formatexpr=Format()
+ norm gqG
+ bw!
+ set formatexpr=
+endfunc
+
+func Test_normal05_formatexpr_setopt()
+ " Change the 'formatexpr' value in the function
+ new
+ func! Format()
+ set formatexpr=
+ endfunc
+ set formatexpr=Format()
+ norm gqG
+ bw!
+ set formatexpr=
+endfunc
+
func! Test_normal06_formatprg()
" basic test for formatprg
" only test on non windows platform
View
@@ -764,6 +764,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 2323,
+/**/
2322,
/**/
2321,

0 comments on commit d77f9d5

Please sign in to comment.