patch 8.2.1095: may use pointer after freeing it
Problem: May use pointer after freeing it when text properties are used.
Solution: Update redo buffer before calling ml_replace().
diff --git a/src/spellsuggest.c b/src/spellsuggest.c
index c03233f..6f9a756 100644
--- a/src/spellsuggest.c
+++ b/src/spellsuggest.c
@@ -676,8 +676,6 @@
mch_memmove(p, line, c);
STRCPY(p + c, stp->st_word);
STRCAT(p, sug.su_badptr + stp->st_orglen);
- ml_replace(curwin->w_cursor.lnum, p, FALSE);
- curwin->w_cursor.col = c;
// For redo we use a change-word command.
ResetRedobuff();
@@ -686,7 +684,10 @@
stp->st_wordlen + sug.su_badlen - stp->st_orglen);
AppendCharToRedobuff(ESC);
- // After this "p" may be invalid.
+ // "p" may be freed here
+ ml_replace(curwin->w_cursor.lnum, p, FALSE);
+ curwin->w_cursor.col = c;
+
changed_bytes(curwin->w_cursor.lnum, c);
}
}
diff --git a/src/version.c b/src/version.c
index 83f5c2e..4406488 100644
--- a/src/version.c
+++ b/src/version.c
@@ -755,6 +755,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 1095,
+/**/
1094,
/**/
1093,