patch 8.0.0085
Problem: Using freed memory with recursive function call. (Dominique Pelle)
Solution: Make a copy of the function name.
diff --git a/src/eval.c b/src/eval.c
index e92a97f..7ca129b 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -4339,10 +4339,17 @@
* use its contents. */
s = deref_func_name(s, &len, &partial, !evaluate);
- /* Invoke the function. */
- ret = get_func_tv(s, len, rettv, arg,
- curwin->w_cursor.lnum, curwin->w_cursor.lnum,
- &len, evaluate, partial, NULL);
+ /* Need to make a copy, in case evaluating the arguments makes
+ * the name invalid. */
+ s = vim_strsave(s);
+ if (s == NULL)
+ ret = FAIL;
+ else
+ /* Invoke the function. */
+ ret = get_func_tv(s, len, rettv, arg,
+ curwin->w_cursor.lnum, curwin->w_cursor.lnum,
+ &len, evaluate, partial, NULL);
+ vim_free(s);
/* If evaluate is FALSE rettv->v_type was not set in
* get_func_tv, but it's needed in handle_subscript() to parse
diff --git a/src/testdir/test_nested_function.vim b/src/testdir/test_nested_function.vim
index f881730..7e301ed 100644
--- a/src/testdir/test_nested_function.vim
+++ b/src/testdir/test_nested_function.vim
@@ -1,32 +1,42 @@
"Tests for nested functions
"
-function! NestedFunc()
- fu! Func1()
+func NestedFunc()
+ func! Func1()
let g:text .= 'Func1 '
- endfunction
+ endfunc
call Func1()
- fu! s:func2()
+ func! s:func2()
let g:text .= 's:func2 '
- endfunction
+ endfunc
call s:func2()
- fu! s:_func3()
+ func! s:_func3()
let g:text .= 's:_func3 '
- endfunction
+ endfunc
call s:_func3()
let fn = 'Func4'
- fu! {fn}()
+ func! {fn}()
let g:text .= 'Func4 '
- endfunction
+ endfunc
call {fn}()
let fn = 'func5'
- fu! s:{fn}()
+ func! s:{fn}()
let g:text .= 's:func5'
- endfunction
+ endfunc
call s:{fn}()
-endfunction
+endfunc
-function! Test_nested_functions()
+func Test_nested_functions()
let g:text = ''
call NestedFunc()
call assert_equal('Func1 s:func2 s:_func3 Func4 s:func5', g:text)
endfunction
+
+func Test_nested_argument()
+ func g:X()
+ let g:Y = function('sort')
+ endfunc
+ let g:Y = function('sort')
+ echo g:Y([], g:X())
+ delfunc g:X
+ unlet g:Y
+endfunc
diff --git a/src/version.c b/src/version.c
index c4013e7..8b30bae 100644
--- a/src/version.c
+++ b/src/version.c
@@ -765,6 +765,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 85,
+/**/
84,
/**/
83,