commit 1be5b375c4446976eb5a0a90d2cfa1d2d289a6ed
author John Marriott <basilisk@internode.on.net> Mon Jun 23 19:57:29 2025 +0200
committer Christian Brabandt <cb@256bit.org> Mon Jun 23 19:57:29 2025 +0200
tree 4ee9d42aba6dcf4c01acb297d6cc60bf45737b8f
parent 5bbdd0b082344e77899585db66cfadb32b9186f9

patch 9.1.1476: missing out-of-memory checks in cmdexpand.c

Problem:  missing out-of-memory checks in cmdexpand.c
Solution: add missing out-of-memory checks, re-order code
          (John Marriott)

This commit does the following:
- in cmdline_pum_create() add out-of-memory check call of ALLOC_MULT()
- in expand_cmdline() move check for out-of-memory to cover both
  assignments of file_str
- in nextwild() don't free `p2` until after it's last use.

closes: #17592

Signed-off-by: John Marriott <basilisk@internode.on.net>
Signed-off-by: Christian Brabandt <cb@256bit.org>

src/cmdexpand.c

diff --git a/src/cmdexpand.c b/src/cmdexpand.c
index a6d8c85..4077fb3 100644
--- a/src/cmdexpand.c
+++ b/src/cmdexpand.c
@@ -335,7 +335,6 @@
 	    ccline->cmdpos += difflen;
 	}
     }
-    vim_free(p2);
 
     redrawcmd();
     cursorcmd();
@@ -351,6 +350,8 @@
 	// free expanded pattern
 	(void)ExpandOne(xp, NULL, NULL, 0, WILD_FREE);
 
+    vim_free(p2);
+
     return OK;
 }
 
@@ -370,8 +371,11 @@
     int		columns;
 
     // Add all the completion matches
+    compl_match_array = ALLOC_MULT(pumitem_T, numMatches);
+    if (compl_match_array == NULL)
+	return EXPAND_UNSUCCESSFUL;
+
     compl_match_arraysize = numMatches;
-    compl_match_array = ALLOC_MULT(pumitem_T, compl_match_arraysize);
     for (i = 0; i < numMatches; i++)
     {
 	compl_match_array[i].pum_text = SHOW_MATCH(i);
@@ -2884,11 +2888,9 @@
 	// If fuzzy matching, don't modify the search string
 	file_str = vim_strsave(xp->xp_pattern);
     else
-    {
 	file_str = addstar(xp->xp_pattern, xp->xp_pattern_len, xp->xp_context);
-	if (file_str == NULL)
-	    return EXPAND_UNSUCCESSFUL;
-    }
+    if (file_str == NULL)
+	return EXPAND_UNSUCCESSFUL;
 
     if (p_wic)
 	options += WILD_ICASE;