patch 8.1.0917: double free when running out of memory
Problem: Double free when running out of memory.
Solution: Remove one free. (Ken Takata, closes #3955)
diff --git a/src/userfunc.c b/src/userfunc.c
index a293dd6..6deb8a9 100644
--- a/src/userfunc.c
+++ b/src/userfunc.c
@@ -205,6 +205,7 @@
garray_T newlines;
garray_T *pnewargs;
ufunc_T *fp = NULL;
+ partial_T *pt = NULL;
int varargs;
int ret;
char_u *start = skipwhite(*arg + 1);
@@ -252,7 +253,6 @@
int len, flags = 0;
char_u *p;
char_u name[20];
- partial_T *pt;
sprintf((char*)name, "<lambda>%d", ++lambda_no);
@@ -261,10 +261,7 @@
goto errret;
pt = (partial_T *)alloc_clear((unsigned)sizeof(partial_T));
if (pt == NULL)
- {
- vim_free(fp);
goto errret;
- }
ga_init2(&newlines, (int)sizeof(char_u *), 1);
if (ga_grow(&newlines, 1) == FAIL)
@@ -318,6 +315,7 @@
ga_clear_strings(&newargs);
ga_clear_strings(&newlines);
vim_free(fp);
+ vim_free(pt);
eval_lavars_used = old_eval_lavars;
return FAIL;
}