vim-patch:9.0.0213: using freed memory with error in assert argument

Problem:    Using freed memory with error in assert argument.
Solution:   Make a copy of the error.

249e1b903a

Co-authored-by: Bram Moolenaar <Bram@vim.org>
This commit is contained in:
zeertzjq 2023-05-04 21:49:48 +08:00
parent 0a3a2132d4
commit 17c8e39f88
2 changed files with 8 additions and 1 deletions

View File

@ -510,6 +510,7 @@ void f_assert_fails(typval_T *argvars, typval_T *rettv, EvalFuncData fptr)
const int save_trylevel = trylevel;
const int called_emsg_before = called_emsg;
const char *wrong_arg_msg = NULL;
char *tofree = NULL;
if (tv_check_for_string_or_number_arg(argvars, 0) == FAIL
|| tv_check_for_opt_string_or_list_arg(argvars, 1) == FAIL
@ -560,8 +561,9 @@ void f_assert_fails(typval_T *argvars, typval_T *rettv, EvalFuncData fptr)
error_found = true;
expected_str = expected;
} else if (tv_list_len(list) == 2) {
// make a copy, an error in pattern_match() may free it
tofree = actual = xstrdup(get_vim_var_str(VV_ERRMSG));
tv = TV_LIST_ITEM_TV(tv_list_last(list));
actual = get_vim_var_str(VV_ERRMSG);
expected = tv_get_string_buf_chk(tv, buf);
if (!pattern_match(expected, actual, false)) {
error_found = true;
@ -632,6 +634,7 @@ theend:
msg_reset_scroll();
lines_left = Rows;
XFREE_CLEAR(emsg_assert_fails_msg);
xfree(tofree);
set_vim_var_string(VV_ERRMSG, NULL, 0);
if (wrong_arg_msg != NULL) {
emsg(_(wrong_arg_msg));

View File

@ -277,6 +277,10 @@ func Test_assert_fail_fails()
let exp = v:exception
endtry
call assert_match("E1174: String required for argument 5", exp)
call assert_equal(1, assert_fails('c0', ['', '\1']))
call assert_match("Expected '\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors[0])
call remove(v:errors, 0)
endfunc
func Test_assert_fails_in_try_block()