To: vim-dev@vim.org
Subject: Patch 7.2.297
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 7.2.297
Problem:    Reading freed memory when writing ":reg" output to a register.
	    (Dominique Pelle)
Solution:   Skip the register being written to.
Files:	    src/ops.c


*** ../vim-7.2.296/src/ops.c	2009-11-11 17:22:30.000000000 +0100
--- src/ops.c	2009-11-11 19:30:47.000000000 +0100
***************
*** 3991,3996 ****
--- 3991,4004 ----
  	}
  	else
  	    yb = &(y_regs[i]);
+ 
+ #ifdef FEAT_EVAL
+ 	if (name == MB_TOLOWER(redir_reg)
+ 		|| (redir_reg == '"' && yb == y_previous))
+ 	    continue;	    /* do not list register being written to, the
+ 			     * pointer can be freed */
+ #endif
+ 
  	if (yb->y_array != NULL)
  	{
  	    msg_putchar('\n');
***************
*** 6090,6096 ****
      long	maxlen;
  #endif
  
!     if (y_ptr->y_array == NULL)		/* NULL means emtpy register */
  	y_ptr->y_size = 0;
  
      /*
--- 6098,6104 ----
      long	maxlen;
  #endif
  
!     if (y_ptr->y_array == NULL)		/* NULL means empty register */
  	y_ptr->y_size = 0;
  
      /*
*** ../vim-7.2.296/src/version.c	2009-11-17 12:31:30.000000000 +0100
--- src/version.c	2009-11-17 12:42:28.000000000 +0100
***************
*** 683,684 ****
--- 683,686 ----
  {   /* Add new patch number below this line */
+ /**/
+     297,
  /**/

-- 
"Beware of bugs in the above code; I have only proved
it correct, not tried it." -- Donald Knuth

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\        download, build and distribute -- http://www.A-A-P.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///