opensourcemirror
/
neovim
mirror of https://github.com/neovim/neovim.git
1
0
Fork 0
Code Issues Releases Wiki Activity

vim-patch:8.2.1095: may use pointer after freeing it 

Problem:    May use pointer after freeing it when text properties are used.
Solution:   Update redo buffer before calling ml_replace().
6b949615ed
This commit is contained in:
Jan Edmund Lazo 2020-06-30 00:11:18 -04:00
parent f01bb307fd
commit e84c075ad9
No known key found for this signature in database
GPG Key ID: 64915E6E9F735B15
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/nvim/spell.c
View File

@ -2930,8 +2930,6 @@ void spell_suggest(int count)
memmove(p, line, c);
STRCPY(p + c, stp->st_word);
STRCAT(p, sug.su_badptr + stp->st_orglen);
ml_replace(curwin->w_cursor.lnum, p, false);
curwin->w_cursor.col = c;
// For redo we use a change-word command.
ResetRedobuff();
@ -2940,7 +2938,10 @@ void spell_suggest(int count)
stp->st_wordlen + sug.su_badlen - stp->st_orglen);
AppendCharToRedobuff(ESC);
// After this "p" may be invalid.
// "p" may be freed here
ml_replace(curwin->w_cursor.lnum, p, false);
curwin->w_cursor.col = c;
changed_bytes(curwin->w_cursor.lnum, c);
} else
curwin->w_cursor = prev_cursor;