Commit: patch 9.2.0933: u_read_undo() leaks the file name when the undo file owner differs

[Christian Brabandt]

patch 9.2.0933: u_read_undo() leaks the file name when the undo file owner differs

Commit: https://github.com/vim/vim/commit/d03735e8d29a228e6a37300335983101edb69431
Author: Samuel Schlesinger <sgschl...@gmail.com>
Date: Mon Aug 10 20:46:08 2026 +0000

patch 9.2.0933: u_read_undo() leaks the file name when the undo file owner differs

Problem: When the owner of an undo file differs from the owner of
the text file and the current user, u_read_undo() returns
without freeing the file name it allocated with
u_get_undo_file_name().
Solution: Free the file name before returning (Samuel Schlesinger).

Every other exit of the function frees it under the "theend" label;
this early return sits before the file pointer is initialized, so it
cannot use that label.

closes: #20987

Co-Authored-By: Claude <nor...@anthropic.com>
Signed-off-by: Samuel Schlesinger <sgschl...@gmail.com>
Signed-off-by: Christian Brabandt <c...@256bit.org>

diff --git a/src/undo.c b/src/undo.c
index 06efd9230..748b38054 100644
--- a/src/undo.c
+++ b/src/undo.c
@@ -1881,6 +1881,7 @@ u_read_undo(char_u *name, char_u *hash, char_u *orig_name UNUSED)
file_name);
verbose_leave();
}
+ vim_free(file_name);
return;
}
# endif
diff --git a/src/version.c b/src/version.c
index a33437590..81a7d542c 100644
--- a/src/version.c
+++ b/src/version.c
@@ -763,6 +763,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 933,
/**/
932,
/**/