commit 42f45b850df93b806ef44f3025aecedfffb9ae01
author Bram Moolenaar <Bram@vim.org> Tue Mar 14 22:17:14 2017 +0100
committer Bram Moolenaar <Bram@vim.org> Tue Mar 14 22:17:14 2017 +0100
tree 1f3af227f1dd63429598d15463b6c5130c6f0495
parent 88d298aed8682eac872ebfe40df3112a6acd83e8

patch 8.0.0458: potential crash if adding list or dict to dict fails

Problem:    Potential crash if adding list or dict to dict fails.
Solution:   Make sure the reference count is correct. (Nikolai Pavlov, closes
            #1555)

src/dict.c

diff --git a/src/dict.c b/src/dict.c
index 7074305..a26419b 100644
--- a/src/dict.c
+++ b/src/dict.c
@@ -356,12 +356,12 @@
     item->di_tv.v_lock = 0;
     item->di_tv.v_type = VAR_LIST;
     item->di_tv.vval.v_list = list;
+    ++list->lv_refcount;
     if (dict_add(d, item) == FAIL)
     {
 	dictitem_free(item);
 	return FAIL;
     }
-    ++list->lv_refcount;
     return OK;
 }
 
@@ -380,12 +380,12 @@
     item->di_tv.v_lock = 0;
     item->di_tv.v_type = VAR_DICT;
     item->di_tv.vval.v_dict = dict;
+    ++dict->dv_refcount;
     if (dict_add(d, item) == FAIL)
     {
 	dictitem_free(item);
 	return FAIL;
     }
-    ++dict->dv_refcount;
     return OK;
 }