patch 8.0.0342: double free with EXITFREE and setting 'ttytype'
Problem: Double free when compiled with EXITFREE and setting 'ttytype'.
Solution: Avoid setting P_ALLOCED on 'ttytype'. (Dominique Pelle,
closes #1461)
diff --git a/src/option.c b/src/option.c
index b5f3a9a..48a8048 100644
--- a/src/option.c
+++ b/src/option.c
@@ -3775,7 +3775,7 @@
if (options[i].indir == PV_NONE)
{
/* global option: free value and default value. */
- if (options[i].flags & P_ALLOCED && options[i].var != NULL)
+ if ((options[i].flags & P_ALLOCED) && options[i].var != NULL)
free_string_option(*(char_u **)options[i].var);
if (options[i].flags & P_DEF_ALLOCED)
free_string_option(options[i].def_val[VI_DEFAULT]);
@@ -5929,8 +5929,14 @@
else if (set_termname(T_NAME) == FAIL)
errmsg = (char_u *)N_("E522: Not found in termcap");
else
+ {
/* Screen colors may have changed. */
redraw_later_clear();
+
+ /* Both 'term' and 'ttytype' point to T_NAME, only set the
+ * P_ALLOCED flag on 'term'. */
+ opt_idx = findoption((char_u *)"term");
+ }
}
/* 'backupcopy' */