patch 8.0.0342: double free with EXITFREE and setting 'ttytype'
Problem: Double free when compiled with EXITFREE and setting 'ttytype'.
Solution: Avoid setting P_ALLOCED on 'ttytype'. (Dominique Pelle,
closes #1461)
diff --git a/src/option.c b/src/option.c
index b5f3a9a..48a8048 100644
--- a/src/option.c
+++ b/src/option.c
@@ -3775,7 +3775,7 @@
if (options[i].indir == PV_NONE)
{
/* global option: free value and default value. */
- if (options[i].flags & P_ALLOCED && options[i].var != NULL)
+ if ((options[i].flags & P_ALLOCED) && options[i].var != NULL)
free_string_option(*(char_u **)options[i].var);
if (options[i].flags & P_DEF_ALLOCED)
free_string_option(options[i].def_val[VI_DEFAULT]);
@@ -5929,8 +5929,14 @@
else if (set_termname(T_NAME) == FAIL)
errmsg = (char_u *)N_("E522: Not found in termcap");
else
+ {
/* Screen colors may have changed. */
redraw_later_clear();
+
+ /* Both 'term' and 'ttytype' point to T_NAME, only set the
+ * P_ALLOCED flag on 'term'. */
+ opt_idx = findoption((char_u *)"term");
+ }
}
/* 'backupcopy' */
diff --git a/src/testdir/test_options.vim b/src/testdir/test_options.vim
index 31a87af..9ac46f2 100644
--- a/src/testdir/test_options.vim
+++ b/src/testdir/test_options.vim
@@ -235,3 +235,22 @@
call assert_fails("set showbreak=\x01", 'E595:')
call assert_fails('set t_foo=', 'E846:')
endfunc
+
+func Test_set_ttytype()
+ if !has('gui_running') && has('unix')
+ " Setting 'ttytype' used to cause a double-free when exiting vim and
+ " when vim is compiled with -DEXITFREE.
+ set ttytype=ansi
+ call assert_equal('ansi', &ttytype)
+ call assert_equal(&ttytype, &term)
+ set ttytype=xterm
+ call assert_equal('xterm', &ttytype)
+ call assert_equal(&ttytype, &term)
+ " FIXME: "set ttytype=" gives E522 instead of E529
+ " in travis on some builds. Why? Commented out this test for now.
+ " call assert_fails('set ttytype=', 'E529:')
+ call assert_fails('set ttytype=xxx', 'E522:')
+ set ttytype&
+ call assert_equal(&ttytype, &term)
+ endif
+endfunc
diff --git a/src/version.c b/src/version.c
index f12c508..c1dff6c 100644
--- a/src/version.c
+++ b/src/version.c
@@ -765,6 +765,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 342,
+/**/
341,
/**/
340,