Commit: patch 9.2.0409: memory leaks in copy_substring_from_pos()

[Christian Brabandt]

patch 9.2.0409: memory leaks in copy_substring_from_pos()

Commit: https://github.com/vim/vim/commit/6cb4173294d0a9612bf105f1c8e492f47a56a568
Author: glepnir <gleph...@gmail.com>
Date: Tue Apr 28 19:14:22 2026 +0000

patch 9.2.0409: memory leaks in copy_substring_from_pos()

Problem: Memory leak in error path of copy_substring_from_pos().
Solution: Free the garray on OOM in copy_substring_from_pos()
(glepnir).

closes: #20086

Signed-off-by: glepnir <gleph...@gmail.com>
Signed-off-by: Christian Brabandt <c...@256bit.org>

diff --git a/src/cmdexpand.c b/src/cmdexpand.c
index 478cda25a..2a8bd31b2 100644
--- a/src/cmdexpand.c
+++ b/src/cmdexpand.c
@@ -4771,7 +4771,7 @@ copy_substring_from_pos(pos_T *start, pos_T *end, char_u **match,
segment_len = is_single_line ? (end->col - start->col)
: (int)(ml_get_len(start->lnum) - start->col);
if (ga_grow(&ga, segment_len + 2) != OK)
- return FAIL;
+ goto fail;

ga_concat_len(&ga, start_ptr, segment_len);
if (!is_single_line)
@@ -4806,13 +4806,13 @@ copy_substring_from_pos(pos_T *start, pos_T *end, char_u **match,
word_end = find_word_end(end_line + end->col);
segment_len = (int)(word_end - end_line);
if (ga_grow(&ga, segment_len) != OK)
- return FAIL;
+ goto fail;
ga_concat_len(&ga, end_line + (is_single_line ? end->col : 0),
segment_len - (is_single_line ? end->col : 0));

// Null-terminate
if (ga_grow(&ga, 1) != OK)
- return FAIL;
+ goto fail;
ga_append(&ga, NUL);

*match = (char_u *)ga.ga_data;
@@ -4820,6 +4820,10 @@ copy_substring_from_pos(pos_T *start, pos_T *end, char_u **match,
match_end->col = segment_len;

return OK;
+
+fail:
+ ga_clear(&ga);
+ return FAIL;
}

/*
diff --git a/src/version.c b/src/version.c
index 406bccd54..c1b9f298a 100644
--- a/src/version.c
+++ b/src/version.c
@@ -729,6 +729,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 409,
/**/
408,
/**/