kevin/neovim
1
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2024-12-22 12:15:06 -07:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.0.0342: double free with EXITFREE and setting 'ttytype'

Browse Source 
Problem:    Double free when compiled with EXITFREE and setting 'ttytype'.
Solution:   Avoid setting P_ALLOCED on 'ttytype'. (Dominique Pelle,
            closes vim/vim#1461)
673911457d
This commit is contained in:
Justin M. Keyes 2018-05-19 12:24:54 +02:00
parent a5de6770c5
commit 39f16a0fee
2 changed files with 30 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
src/nvim/option.c
View File

@ -913,27 +913,24 @@ void set_number_default(char *name, long val)
}
#if defined(EXITFREE)
/*
* Free all options.
*/
/// Free all options.
void free_all_options(void)
{
int i;
for (i = 0; options[i].fullname; i++) {
for (int i = 0; options[i].fullname; i++) {
if (options[i].indir == PV_NONE) {
/* global option: free value and default value. */
if (options[i].flags & P_ALLOCED && options[i].var != NULL)
// global option: free value and default value.
if ((options[i].flags & P_ALLOCED) && options[i].var != NULL) {
free_string_option(*(char_u **)options[i].var);
if (options[i].flags & P_DEF_ALLOCED)
}
if (options[i].flags & P_DEF_ALLOCED) {
free_string_option(options[i].def_val[VI_DEFAULT]);
} else if (options[i].var != VAR_WIN
&& (options[i].flags & P_STRING))
/* buffer-local option: free global value */
}
} else if (options[i].var != VAR_WIN && (options[i].flags & P_STRING)) {
// buffer-local option: free global value
free_string_option(*(char_u **)options[i].var);
}
}
}
#endif

20
src/nvim/testdir/test_options.vim
View File

@ -227,6 +227,26 @@ func Test_set_errors()
call assert_fails('set t_foo=', 'E846:')
endfunc
func Test_set_ttytype()
" Nvim does not support 'ttytype'.
if !has('nvim') && !has('gui_running') && has('unix')
" Setting 'ttytype' used to cause a double-free when exiting vim and
" when vim is compiled with -DEXITFREE.
set ttytype=ansi
call assert_equal('ansi', &ttytype)
call assert_equal(&ttytype, &term)
set ttytype=xterm
call assert_equal('xterm', &ttytype)
call assert_equal(&ttytype, &term)
" FIXME: "set ttytype=" gives E522 instead of E529
" in travis on some builds. Why? Commented out this test for now.
" call assert_fails('set ttytype=', 'E529:')
call assert_fails('set ttytype=xxx', 'E522:')
set ttytype&
call assert_equal(&ttytype, &term)
endif
endfunc
func Test_complete()
" Trailing single backslash used to cause invalid memory access.
set complete=s\