patch 8.2.4587: Vim9: double free after unpacking a list

Problem:    Vim9: double free after unpacking a list.
Solution:   Make a copy of the value instead of moving it. (closes #9968)

diff --git a/src/testdir/test_vim9_script.vim b/src/testdir/test_vim9_script.vim
index 94aa1e9d271853709cf76c88e5adc1b47622644f..c94f29870832293fecad137e6c82d28960a90589 100644 (file)
--- a/src/testdir/test_vim9_script.vim
+++ b/src/testdir/test_vim9_script.vim
@@ -2253,6 +2253,13 @@ def Test_for_loop_unpack()
         res->add(n)
       endfor
       assert_equal([2, 5], res)
+
+      var text: list<string> = ["hello there", "goodbye now"]
+      var splitted = ''
+      for [first; next] in mapnew(text, (i, v) => split(v))
+          splitted ..= string(first) .. string(next) .. '/'
+      endfor
+      assert_equal("'hello'['there']/'goodbye'['now']/", splitted)
   END
   v9.CheckDefAndScriptSuccess(lines)
 

diff --git a/src/version.c b/src/version.c
index b90c57123668fb8d019b15953b8249831ced2fce..5cb21e832f3b48add4e37bab0ea5b1dd3fef1e7d 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4587,
 /**/
     4586,
 /**/

diff --git a/src/vim9execute.c b/src/vim9execute.c
index 4d24eb96eb72cab8569271bf52ecac10f23cee3f..3136dced79e0bb26ebcb0e6d3fc208974fca6aad 100644 (file)
--- a/src/vim9execute.c
+++ b/src/vim9execute.c
@@ -4773,7 +4773,10 @@ exec_instructions(ectx_T *ectx)
                            li = li->li_next;
                        for (i = 0; li != NULL; ++i)
                        {
-                           list_set_item(rem_list, i, &li->li_tv);
+                           typval_T tvcopy;
+
+                           copy_tv(&li->li_tv, &tvcopy);
+                           list_set_item(rem_list, i, &tvcopy);
                            li = li->li_next;
                        }
                        --count;