Commit: patch 9.2.0798: Memory leak in compile_expr6() on alloc failure

[Christian Brabandt]

patch 9.2.0798: Memory leak in compile_expr6() on alloc failure

Commit: https://github.com/vim/vim/commit/4607659b1291d5a7b1a0a94cb4bb02fec33b2902
Author: Yasuhiro Matsumoto <matt...@gmail.com>
Date: Sat Jul 18 14:25:10 2026 +0000

patch 9.2.0798: Memory leak in compile_expr6() on alloc failure

Problem: Memory leak in compile_expr6() on alloc failure
Solution: Free left string when constant string concat alloc fails
(Yasuhiro Matsumoto).

compile_expr6() overwrote tv1's string pointer before allocating the
concatenation buffer, leaking the original left-hand string on failure.

related: #20668
related: #20745

Signed-off-by: Yasuhiro Matsumoto <matt...@gmail.com>
Signed-off-by: Christian Brabandt <c...@256bit.org>

diff --git a/src/version.c b/src/version.c
index a234bad44..b3d1e6aed 100644
--- a/src/version.c
+++ b/src/version.c
@@ -759,6 +759,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 798,
/**/
797,
/**/
diff --git a/src/vim9expr.c b/src/vim9expr.c
index 4331d3f5b..f69488d5b 100644
--- a/src/vim9expr.c
+++ b/src/vim9expr.c
@@ -3377,6 +3377,7 @@ compile_expr6(char_u **arg, cctx_T *cctx, ppconst_T *ppconst)
tv1->vval.v_string = alloc(len1 + STRLEN(s2) + 1);
if (tv1->vval.v_string == NULL)
{
+ vim_free(s1);
clear_ppconst(ppconst);
return FAIL;
}