patch 8.1.2091: double free when memory allocation fails

Problem:    Double free when memory allocation fails. (Zu-Ming Jiang)
Solution:   Use VIM_CLEAR() instead of vim_free(). (closes #4991)

diff --git a/src/getchar.c b/src/getchar.c
index 1056e938ed606ee8e0284e82d5fb856bc58742f9..fcdc639688b36b265d3171b9d5f89f3d321f192e 100644 (file)
--- a/src/getchar.c
+++ b/src/getchar.c
@@ -1296,11 +1296,11 @@ free_typebuf(void)
     if (typebuf.tb_buf == typebuf_init)
        internal_error("Free typebuf 1");
     else
-       vim_free(typebuf.tb_buf);
+       VIM_CLEAR(typebuf.tb_buf);
     if (typebuf.tb_noremap == noremapbuf_init)
        internal_error("Free typebuf 2");
     else
-       vim_free(typebuf.tb_noremap);
+       VIM_CLEAR(typebuf.tb_noremap);
 }
 
 /*

diff --git a/src/version.c b/src/version.c
index e595c7ab6ed361d0dfe1ab50f64e6b2a38604b93..2d9ffa3577f5a53b1d0a947f630571d66953f232 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -757,6 +757,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2091,
 /**/
     2090,
 /**/