patch 9.0.1095: using freed memory when declaration fails
Problem: Using freed memory when declaration fails. (Yegappan Lakshmanan)
Solution: After unreferencing an object set the reference to NULL.
diff --git a/src/testdir/test_vim9_class.vim b/src/testdir/test_vim9_class.vim
index c73e80f..7e4c92d 100644
--- a/src/testdir/test_vim9_class.vim
+++ b/src/testdir/test_vim9_class.vim
@@ -349,6 +349,22 @@
assert_equal('make = 123', c2.GetMake())
END
v9.CheckScriptSuccess(lines)
+
+ lines =<< trim END
+ vim9script
+
+ class MyCar
+ this.make: string
+
+ def new(make_arg: string)
+ this.make = make_arg
+ enddef
+ endclass
+
+ var c = MyCar.new("abc")
+ var c = MyCar.new("def")
+ END
+ v9.CheckScriptFailure(lines, 'E1041:')
enddef
def Test_class_member_access()
diff --git a/src/typval.c b/src/typval.c
index 98915cc..6eae02b 100644
--- a/src/typval.c
+++ b/src/typval.c
@@ -162,9 +162,11 @@
break;
case VAR_CLASS:
class_unref(varp->vval.v_class);
+ varp->vval.v_class = NULL;
break;
case VAR_OBJECT:
object_unref(varp->vval.v_object);
+ varp->vval.v_object = NULL;
break;
case VAR_UNKNOWN:
case VAR_ANY:
diff --git a/src/version.c b/src/version.c
index 95d2a6b..36d3f81 100644
--- a/src/version.c
+++ b/src/version.c
@@ -696,6 +696,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 1095,
+/**/
1094,
/**/
1093,