[vim/vim] patch 9.2.XXXX: double-free in string_reduce() (PR #21048)

4 views

Skip to first unread message

Christian Brabandt

unread,

Aug 14, 2026, 3:20:21 AM (2 days ago) Aug 14

to vim/vim, Subscribed

Problem: string_reduce() copies *rettv into argv[0] before calling
eval_expr_typval(). When the evaluator fails early, rettv is never
reset and still aliases argv[0]'s v_string. clear_tv(&argv[0]) frees
it, leaving rettv dangling. In vim9script get_func_tv() then frees it
again.
Solution: Null out argv[0].vval.v_string before clearing it when it
aliases rettv->vval.v_string.

Supported by AI

You can view, comment on, or merge this pull request online at:

https://github.com/vim/vim/pull/21048

Commit Summary

9c7e639 patch 9.2.XXXX: double-free in string_reduce()

File Changes

(2 files)

M src/strings.c (6)
M src/testdir/test_listdict.vim (7)

Patch Links:

—
Reply to this email directly, view it on GitHub, or unsubscribe.
Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS and Android. Download it today!
You are receiving this because you are subscribed to this thread.

Reply all

Reply to author

Forward

0 new messages