patch 8.2.0571: double free when passing invalid argument to job_start()

Problem:    Double free when passing invalid argument to job_start().
Solution:   Clear the argument when freed. (Masato Nishihata, closes #5926)

diff --git a/src/misc2.c b/src/misc2.c
index 491818927596d9eb8274b10ae091be9be9e8ed7b..5fc20405a56c554c14062b985d90e3ebf36d53bc 100644 (file)
--- a/src/misc2.c
+++ b/src/misc2.c
@@ -4356,7 +4356,10 @@ build_argv_from_list(list_T *l, char ***argv, int *argc)
            int i;
 
            for (i = 0; i < *argc; ++i)
+           {
                vim_free((*argv)[i]);
+               (*argv)[i] = NULL;
+           }
            return FAIL;
        }
        (*argv)[*argc] = (char *)vim_strsave(s);

diff --git a/src/testdir/test_channel.vim b/src/testdir/test_channel.vim
index 11f33628d8ff415cc9fb65c611050ef8ab56dcf2..af809eceb4c5bc0ccfdc7759302ab44e3c5d473c 100644 (file)
--- a/src/testdir/test_channel.vim
+++ b/src/testdir/test_channel.vim
@@ -1681,6 +1681,7 @@ func Test_job_start_fails()
   call assert_fails('let job = job_start(["   "])', 'E474:')
   call assert_fails('let job = job_start("")', 'E474:')
   call assert_fails('let job = job_start("   ")', 'E474:')
+  call assert_fails('let job = job_start(["ls", []])', 'E730:')
   %bw!
 endfunc
 

diff --git a/src/version.c b/src/version.c
index df1dcec7a1d8d5ae0ed0e0288ff1c4af68ed4576..40e048d6845d82bc4602e487191d7dcf04ff6e56 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -738,6 +738,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    571,
 /**/
     570,
 /**/