patch 8.2.4587: Vim9: double free after unpacking a list
Problem: Vim9: double free after unpacking a list.
Solution: Make a copy of the value instead of moving it. (closes #9968)
diff --git a/src/vim9execute.c b/src/vim9execute.c
index 4d24eb9..3136dce 100644
--- a/src/vim9execute.c
+++ b/src/vim9execute.c
@@ -4773,7 +4773,10 @@
li = li->li_next;
for (i = 0; li != NULL; ++i)
{
- list_set_item(rem_list, i, &li->li_tv);
+ typval_T tvcopy;
+
+ copy_tv(&li->li_tv, &tvcopy);
+ list_set_item(rem_list, i, &tvcopy);
li = li->li_next;
}
--count;