patch 9.1.1400: [security]: use-after-free when evaluating tuple fails
Problem: [security]: use-after-free when evaluating tuple fails
Solution: return early in case of an error (Yegappan Lakshmanan)
closes: #17351
Signed-off-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/eval.c b/src/eval.c
index 530cc95..bbfe566 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -5000,6 +5000,8 @@
else
{
ret = eval1(arg, rettv, evalarg); // recursive!
+ if (ret != OK)
+ return ret;
*arg = skipwhite_and_linebreak(*arg, evalarg);