Patch 8.2.3779

[Bram Moolenaar]

Patch 8.2.3779
Problem: Using freed memory when defining a user command from a user
command.
Solution: Do not use the command pointer after executing the command.
(closes #9318)
Files: src/usercmd.c, src/testdir/test_usercommands.vim


*** ../vim-8.2.3778/src/usercmd.c 2021-12-04 11:56:30.352101259 +0000
--- src/usercmd.c 2021-12-10 21:44:34.272071740 +0000
***************
*** 1670,1676 ****
size_t split_len = 0;
char_u *split_buf = NULL;
ucmd_T *cmd;
! sctx_T save_current_sctx = current_sctx;

if (eap->cmdidx == CMD_USER)
cmd = USER_CMD(eap->useridx);
--- 1670,1677 ----
size_t split_len = 0;
char_u *split_buf = NULL;
ucmd_T *cmd;
! sctx_T save_current_sctx;
! int restore_current_sctx = FALSE;

if (eap->cmdidx == CMD_USER)
cmd = USER_CMD(eap->useridx);
***************
*** 1771,1784 ****

if ((cmd->uc_argt & EX_KEEPSCRIPT) == 0)
{
current_sctx.sc_version = cmd->uc_script_ctx.sc_version;
#ifdef FEAT_EVAL
current_sctx.sc_sid = cmd->uc_script_ctx.sc_sid;
#endif
}
(void)do_cmdline(buf, eap->getline, eap->cookie,
DOCMD_VERBOSE|DOCMD_NOWAIT|DOCMD_KEYTYPED);
! if ((cmd->uc_argt & EX_KEEPSCRIPT) == 0)
current_sctx = save_current_sctx;
vim_free(buf);
vim_free(split_buf);
--- 1772,1791 ----

if ((cmd->uc_argt & EX_KEEPSCRIPT) == 0)
{
+ restore_current_sctx = TRUE;
+ save_current_sctx = current_sctx;
current_sctx.sc_version = cmd->uc_script_ctx.sc_version;
#ifdef FEAT_EVAL
current_sctx.sc_sid = cmd->uc_script_ctx.sc_sid;
#endif
}
+
(void)do_cmdline(buf, eap->getline, eap->cookie,
DOCMD_VERBOSE|DOCMD_NOWAIT|DOCMD_KEYTYPED);
!
! // Careful: Do not use "cmd" here, it may have become invalid if a user
! // command was added.
! if (restore_current_sctx)
current_sctx = save_current_sctx;
vim_free(buf);
vim_free(split_buf);
*** ../vim-8.2.3778/src/testdir/test_usercommands.vim 2021-11-29 12:12:38.175653429 +0000
--- src/testdir/test_usercommands.vim 2021-12-10 21:43:39.528127021 +0000
***************
*** 704,708 ****
--- 704,727 ----
delcommand GetCount
enddef

+ func DefCmd(name)
+ if len(a:name) > 30
+ return
+ endif
+ exe 'command ' .. a:name .. ' call DefCmd("' .. a:name .. 'x")'
+ echo a:name
+ exe a:name
+ endfunc
+
+ func Test_recursive_define()
+ call DefCmd('Command')
+
+ let name = 'Command'
+ while len(name) < 30
+ exe 'delcommand ' .. name
+ let name ..= 'x'
+ endwhile
+ endfunc
+

" vim: shiftwidth=2 sts=2 expandtab
*** ../vim-8.2.3778/src/version.c 2021-12-10 21:05:50.205426652 +0000
--- src/version.c 2021-12-10 21:45:19.728025775 +0000
***************
*** 755,756 ****
--- 755,758 ----
{ /* Add new patch number below this line */
+ /**/
+ 3779,
/**/

--
How To Keep A Healthy Level Of Insanity:
1. At lunch time, sit in your parked car with sunglasses on and point
a hair dryer at passing cars. See if they slow down.

/// Bram Moolenaar -- Br...@Moolenaar.net -- http://www.Moolenaar.net \\\
/// \\\
\\\ sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ ///
\\\ help me help AIDS victims -- http://ICCF-Holland.org ///