[vim/vim] Fix use-after-free in popup_getoptions() on dict_add() failure (PR #20464)

[mattn]

When dict_add() fails, dictitem_free() already frees the blob, but the cleanup then reads the freed blob's refcount and could free it again. Clear the pointer after dictitem_free().

---

You can view, comment on, or merge this pull request online at:

  https://github.com/vim/vim/pull/20464

Commit Summary

• bf35893 Fix use-after-free in popup_getoptions() on dict_add() failure

File Changes

(1 file)

• M src/popupwin.c (2)

Patch Links:

• https://github.com/vim/vim/pull/20464.patch
• https://github.com/vim/vim/pull/20464.diff

—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.Message ID: <vim/vim/pull/20464@github.com>