patch 8.2.5079: DirChanged autocommand may use freed memory
Problem: DirChanged autocommand may use freed memory. (Shane-XB Qian)
Solution: Free the memory later. (closes #10555)
diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index 634a1bc..9a06999 100644
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -7525,6 +7525,7 @@
int dir_differs;
char_u *acmd_fname = NULL;
char_u **pp;
+ char_u *tofree;
if (new_dir == NULL || allbuf_locked())
return FALSE;
@@ -7601,13 +7602,14 @@
pp = &curtab->tp_prevdir;
else
pp = &prev_dir;
- vim_free(*pp);
+ tofree = *pp; // new_dir may use this
*pp = pdir;
post_chdir(scope);
if (dir_differs)
apply_autocmds(EVENT_DIRCHANGED, acmd_fname, new_dir, FALSE, curbuf);
+ vim_free(tofree);
return TRUE;
}
diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
index 24e2ed9..15aab48 100644
--- a/src/testdir/test_autocmd.vim
+++ b/src/testdir/test_autocmd.vim
@@ -2107,6 +2107,13 @@
call assert_equal(expected, s:li)
exe 'lcd ' .. fnameescape(s:dir_bar)
call assert_equal(expected, s:li)
+
+ exe 'cd ' .. s:dir_foo
+ exe 'cd ' .. s:dir_bar
+ autocmd! test_dirchanged DirChanged global let g:result = expand("<afile>")
+ cd -
+ call assert_equal(s:dir_foo, g:result)
+
call s:After_test_dirchanged()
endfunc
diff --git a/src/version.c b/src/version.c
index aec6f4b..47c2466 100644
--- a/src/version.c
+++ b/src/version.c
@@ -735,6 +735,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 5079,
+/**/
5078,
/**/
5077,