commit f3980dc5d0a5f873cf764b8ba3e567e42259e4e5
author Bram Moolenaar <Bram@vim.org> Sat Mar 26 16:42:23 2022 +0000
committer Bram Moolenaar <Bram@vim.org> Sat Mar 26 16:42:23 2022 +0000
tree cc57391efaa80338fa54ad82139456b19f82e431
parent 347538fad0c503249ebdedd5884c2081257c9f61

patch 8.2.4632: using freed memory in flatten()

Problem:    Using freed memory in flatten().
Solution:   Clear typval after recursing into list.

src/list.c

diff --git a/src/list.c b/src/list.c
index 3354068..666fb5a 100644
--- a/src/list.c
+++ b/src/list.c
@@ -953,12 +953,12 @@
 		list_free_item(list, item);
 		return;
 	    }
-	    clear_tv(&item->li_tv);
 
 	    if (maxdepth > 0)
 		list_flatten(list, item->li_prev == NULL
 				     ? list->lv_first : item->li_prev->li_next,
 				itemlist->lv_len, maxdepth - 1);
+	    clear_tv(&item->li_tv);
 	    list_free_item(list, item);
 	}
 

src/version.c

diff --git a/src/version.c b/src/version.c
index 9d78a0e..962fa0b 100644
--- a/src/version.c
+++ b/src/version.c
@@ -751,6 +751,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    4632,
+/**/
     4631,
 /**/
     4630,