patch 8.2.3721: using memory freed by losing the clipboard selection
Problem: Using memory freed by losing the clipboard selection. (Dominique
Pellé)
Solution: Check y_array is still valid after calling changed_lines().
(closes #9253)
diff --git a/src/errors.h b/src/errors.h
index 1d6a3a3..047ff9c 100644
--- a/src/errors.h
+++ b/src/errors.h
@@ -316,7 +316,8 @@
INIT(= N_("E1062: Cannot index a Number"));
EXTERN char e_type_mismatch_for_v_variable[]
INIT(= N_("E1063: Type mismatch for v: variable"));
-// E1064 unused
+EXTERN char e_yank_register_changed_while_using_it[]
+ INIT(= N_("E1064: Yank register changed while using it"));
// E1065 unused
EXTERN char e_cannot_declare_a_register_str[]
INIT(= N_("E1066: Cannot declare a register: %s"));
diff --git a/src/register.c b/src/register.c
index 3fc8b63..cd2e0e1 100644
--- a/src/register.c
+++ b/src/register.c
@@ -1550,6 +1550,7 @@
long j;
struct block_def bd;
char_u **y_array = NULL;
+ yankreg_T *y_current_used = NULL;
long nr_lines = 0;
pos_T new_cursor;
int indent;
@@ -1660,6 +1661,7 @@
y_width = y_current->y_width;
y_size = y_current->y_size;
y_array = y_current->y_array;
+ y_current_used = y_current;
}
if (y_type == MLINE)
@@ -2208,6 +2210,14 @@
else
changed_lines(curbuf->b_op_start.lnum, 0,
curbuf->b_op_start.lnum, nr_lines);
+ if (y_current_used != NULL && (y_current_used != y_current
+ || y_current->y_array != y_array))
+ {
+ // Something invoked through changed_lines() has changed the
+ // yank buffer, e.g. a GUI clipboard callback.
+ emsg(_(e_yank_register_changed_while_using_it));
+ goto end;
+ }
// Put the '] mark on the first byte of the last inserted character.
// Correct the length for change in indent.
diff --git a/src/version.c b/src/version.c
index 810567f..30cd9bc 100644
--- a/src/version.c
+++ b/src/version.c
@@ -754,6 +754,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 3721,
+/**/
3720,
/**/
3719,