patch 9.0.0487: using freed memory with combination of closures
Problem: Using freed memory with combination of closures.
Solution: Do not use a partial after it has been freed through the
funcstack.
diff --git a/src/eval.c b/src/eval.c
index f280e2a..3209d08 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -4876,6 +4876,8 @@
{
if (pt != NULL)
{
+ int done = FALSE;
+
if (--pt->pt_refcount <= 0)
partial_free(pt);
@@ -4883,9 +4885,12 @@
// only reference and can be freed if no other partials reference it.
else if (pt->pt_refcount == 1)
{
+ // careful: if the funcstack is freed it may contain this partial
+ // and it gets freed as well
if (pt->pt_funcstack != NULL)
- funcstack_check_refcount(pt->pt_funcstack);
- if (pt->pt_loopvars != NULL)
+ done = funcstack_check_refcount(pt->pt_funcstack);
+
+ if (!done && pt->pt_loopvars != NULL)
loopvars_check_refcount(pt->pt_loopvars);
}
}