From 112186063a276bb087d9f24656d79ae2a1d06215 Mon Sep 17 00:00:00 2001 From: Karsten Hopp Date: Dec 02 2009 16:38:11 +0000 Subject: - patchlevel 297 --- diff --git a/7.2.297 b/7.2.297 new file mode 100644 index 0000000..cc8d789 --- /dev/null +++ b/7.2.297 @@ -0,0 +1,70 @@ +To: vim-dev@vim.org +Subject: Patch 7.2.297 +Fcc: outbox +From: Bram Moolenaar +Mime-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +------------ + +Patch 7.2.297 +Problem: Reading freed memory when writing ":reg" output to a register. + (Dominique Pelle) +Solution: Skip the register being written to. +Files: src/ops.c + + +*** ../vim-7.2.296/src/ops.c 2009-11-11 17:22:30.000000000 +0100 +--- src/ops.c 2009-11-11 19:30:47.000000000 +0100 +*************** +*** 3991,3996 **** +--- 3991,4004 ---- + } + else + yb = &(y_regs[i]); ++ ++ #ifdef FEAT_EVAL ++ if (name == MB_TOLOWER(redir_reg) ++ || (redir_reg == '"' && yb == y_previous)) ++ continue; /* do not list register being written to, the ++ * pointer can be freed */ ++ #endif ++ + if (yb->y_array != NULL) + { + msg_putchar('\n'); +*************** +*** 6090,6096 **** + long maxlen; + #endif + +! if (y_ptr->y_array == NULL) /* NULL means emtpy register */ + y_ptr->y_size = 0; + + /* +--- 6098,6104 ---- + long maxlen; + #endif + +! if (y_ptr->y_array == NULL) /* NULL means empty register */ + y_ptr->y_size = 0; + + /* +*** ../vim-7.2.296/src/version.c 2009-11-17 12:31:30.000000000 +0100 +--- src/version.c 2009-11-17 12:42:28.000000000 +0100 +*************** +*** 683,684 **** +--- 683,686 ---- + { /* Add new patch number below this line */ ++ /**/ ++ 297, + /**/ + +-- +"Beware of bugs in the above code; I have only proved +it correct, not tried it." -- Donald Knuth + + /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net \\\ +/// sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\ +\\\ download, build and distribute -- http://www.A-A-P.org /// + \\\ help me help AIDS victims -- http://ICCF-Holland.org ///