commit a5d4121eed942bbbc672a7b00bf20866c17dc858
author Bram Moolenaar <Bram@vim.org> Fri Sep 02 22:18:49 2016 +0200
committer Bram Moolenaar <Bram@vim.org> Fri Sep 02 22:18:49 2016 +0200
tree 2bf20302ef42c197e2d7e0592e8da73eb58d9f6b
parent 11fbc2866ccc11b4dd1726abdaf582a78ef3f743

patch 7.4.2310
Problem:    Accessing freed memory when a timer does not repeat.
Solution:   Free after removing it. (Dominique Pelle)

src/ex_cmds2.c

diff --git a/src/ex_cmds2.c b/src/ex_cmds2.c
index a76b055..acaef9f 100644
--- a/src/ex_cmds2.c
+++ b/src/ex_cmds2.c
@@ -1222,8 +1222,8 @@
 		}
 		else
 		{
-		    free_timer(timer);
 		    remove_timer(timer);
+		    free_timer(timer);
 		}
 		/* the callback may do anything, start all over */
 		break;

src/version.c

diff --git a/src/version.c b/src/version.c
index 5fd33ec..784b405 100644
--- a/src/version.c
+++ b/src/version.c
@@ -764,6 +764,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    2310,
+/**/
     2309,
 /**/
     2308,