commit 0f1c6708fdf17bb9c7305b8af5d12189956195b6
author Bram Moolenaar <Bram@vim.org> Sat Sep 28 15:24:00 2019 +0200
committer Bram Moolenaar <Bram@vim.org> Sat Sep 28 15:24:00 2019 +0200
tree 1dd2dcec1013f8b500a1bbf030e5f83b3b24c560
parent 2e47cab715669bd0c89762217cbf77bd70cd82ac

patch 8.1.2091: double free when memory allocation fails

Problem:    Double free when memory allocation fails. (Zu-Ming Jiang)
Solution:   Use VIM_CLEAR() instead of vim_free(). (closes #4991)

src/getchar.c

diff --git a/src/getchar.c b/src/getchar.c
index 1056e93..fcdc639 100644
--- a/src/getchar.c
+++ b/src/getchar.c
@@ -1296,11 +1296,11 @@
     if (typebuf.tb_buf == typebuf_init)
 	internal_error("Free typebuf 1");
     else
-	vim_free(typebuf.tb_buf);
+	VIM_CLEAR(typebuf.tb_buf);
     if (typebuf.tb_noremap == noremapbuf_init)
 	internal_error("Free typebuf 2");
     else
-	vim_free(typebuf.tb_noremap);
+	VIM_CLEAR(typebuf.tb_noremap);
 }
 
 /*