[vim/vim] Vim9 compile_def_function: vim_strsave failure leaves line==NULL then skipwhite(line) NULL-derefs (Issue #20822)

1 view

Skip to first unread message

Shixin Tan

unread,

Jul 23, 2026, 5:53:05 AM (yesterday) Jul 23

to vim/vim, Subscribed

tsx543 created an issue (vim/vim#20822)

Steps to reproduce

Build Vim with +eval / Vim9 script support (default in most builds).
Compile a multi-line :def function so compile_def_function_body() copies each source line with vim_strsave().
Force vim_strsave() to fail (out-of-memory) on one of those lines.
Execution continues: ga_add_string(lines_to_free, line) can still succeed while storing the NULL pointer, then skipwhite(line) dereferences NULL.
Relevant code in current master (src/vim9compile.c):

if (line != NULL)
{
    line = vim_strsave(line);
    if (ga_add_string(lines_to_free, line) == FAIL)
    {
        vim_free(line);
        return FAIL;
    }
}
CLEAR_FIELD(ea);
ea.cmdlinep = &line;
ea.cmd = skipwhite(line);   /* line may be NULL here */

ga_add_string() (src/alloc.c) only fails if ga_grow fails; it does not treat a NULL p as failure:

int
ga_add_string(garray_T *gap, char_u *p)
{
    if (ga_grow(gap, 1) == FAIL)
        return FAIL;
    ((char_u **)(gap->ga_data))[gap->ga_len++] = p;
    return OK;
}

skipwhite() then does while (VIM_ISWHITE(*p)) on a NULL pointer.

Expected behaviour

If vim_strsave(line) returns NULL, compilation should abort with a clear out-of-memory / failure path and must not call skipwhite(NULL) or otherwise dereference the failed allocation result.

Version of Vim

9.2.0838

Environment

Terminal: any
Value of $TERM: any
Shell: any

Logs and stack traces

—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.

h_east

unread,

Jul 23, 2026, 7:24:08 AM (yesterday) Jul 23

to vim/vim, Subscribed

h-east left a comment (vim/vim#20822)

Please do not post AI-generated (LLM) content as-is.
You must verify it yourself before posting.

See AGENTS.md: "Before claiming a bug exists, reproduce it."

This only triggers if vim_strsave() fails under OOM, which cannot be
reproduced from a script, so there is no realistic impact. Closing.