patch 8.0.0342: double free with EXITFREE and setting 'ttytype'

Problem:    Double free when compiled with EXITFREE and setting 'ttytype'.
Solution:   Avoid setting P_ALLOCED on 'ttytype'. (Dominique Pelle,
            closes #1461)

diff --git a/src/option.c b/src/option.c
index b5f3a9a864418f99fa070532f54969c3b44402f6..48a8048cb991da8157a1dd263abed595a201216b 100644 (file)
--- a/src/option.c
+++ b/src/option.c
@@ -3775,7 +3775,7 @@ free_all_options(void)
        if (options[i].indir == PV_NONE)
        {
            /* global option: free value and default value. */
-           if (options[i].flags & P_ALLOCED && options[i].var != NULL)
+           if ((options[i].flags & P_ALLOCED) && options[i].var != NULL)
                free_string_option(*(char_u **)options[i].var);
            if (options[i].flags & P_DEF_ALLOCED)
                free_string_option(options[i].def_val[VI_DEFAULT]);
@@ -5929,8 +5929,14 @@ did_set_string_option(
        else if (set_termname(T_NAME) == FAIL)
            errmsg = (char_u *)N_("E522: Not found in termcap");
        else
+       {
            /* Screen colors may have changed. */
            redraw_later_clear();
+
+           /* Both 'term' and 'ttytype' point to T_NAME, only set the
+            * P_ALLOCED flag on 'term'. */
+           opt_idx = findoption((char_u *)"term");
+       }
     }
 
     /* 'backupcopy' */

diff --git a/src/testdir/test_options.vim b/src/testdir/test_options.vim
index 31a87af70a1a45e30de062ebc77a081b19ebf219..9ac46f243f21a878412d49e944fdff6e2fb05b8c 100644 (file)
--- a/src/testdir/test_options.vim
+++ b/src/testdir/test_options.vim
@@ -235,3 +235,22 @@ func Test_set_errors()
   call assert_fails("set showbreak=\x01", 'E595:')
   call assert_fails('set t_foo=', 'E846:')
 endfunc
+
+func Test_set_ttytype()
+  if !has('gui_running') && has('unix')
+    " Setting 'ttytype' used to cause a double-free when exiting vim and
+    " when vim is compiled with -DEXITFREE.
+    set ttytype=ansi
+    call assert_equal('ansi', &ttytype)
+    call assert_equal(&ttytype, &term)
+    set ttytype=xterm
+    call assert_equal('xterm', &ttytype)
+    call assert_equal(&ttytype, &term)
+    " FIXME: "set ttytype=" gives E522 instead of E529
+    " in travis on some builds. Why? Commented out this test for now.
+    " call assert_fails('set ttytype=', 'E529:')
+    call assert_fails('set ttytype=xxx', 'E522:')
+    set ttytype&
+    call assert_equal(&ttytype, &term)
+  endif
+endfunc

diff --git a/src/version.c b/src/version.c
index f12c508d49f6d1c0134a1ee3a57efe1b06a99eb6..c1dff6cff771511f615762ccd81d9cfbff40a8e0 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -764,6 +764,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    342,
 /**/
     341,
 /**/