patch 9.0.0026: accessing freed memory with diff put
Problem: Accessing freed memory with diff put.
Solution: Bail out when diff pointer is no longer valid.
diff --git a/src/diff.c b/src/diff.c
index 91e5ae2..e4bafe2 100644
--- a/src/diff.c
+++ b/src/diff.c
@@ -2643,6 +2643,20 @@
}
/*
+ * Return TRUE if "diff" appears in the list of diff blocks of the current tab.
+ */
+ static int
+valid_diff(diff_T *diff)
+{
+ diff_T *dp;
+
+ for (dp = curtab->tp_first_diff; dp != NULL; dp = dp->df_next)
+ if (dp == diff)
+ return TRUE;
+ return FALSE;
+}
+
+/*
* ":diffget"
* ":diffput"
*/
@@ -2899,9 +2913,9 @@
}
}
- // Adjust marks. This will change the following entries!
if (added != 0)
{
+ // Adjust marks. This will change the following entries!
mark_adjust(lnum, lnum + count - 1, (long)MAXLNUM, (long)added);
if (curwin->w_cursor.lnum >= lnum)
{
@@ -2923,7 +2937,13 @@
#endif
vim_free(dfree);
}
- else
+
+ // mark_adjust() may have made "dp" invalid. We don't know where
+ // to continue then, bail out.
+ if (added != 0 && !valid_diff(dp))
+ break;
+
+ if (dfree == NULL)
// mark_adjust() may have changed the count in a wrong way
dp->df_count[idx_to] = new_count;
diff --git a/src/version.c b/src/version.c
index 8c9325d..0eb5863 100644
--- a/src/version.c
+++ b/src/version.c
@@ -736,6 +736,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 26,
+/**/
25,
/**/
24,