patch 8.2.1095: may use pointer after freeing it

Problem:    May use pointer after freeing it when text properties are used.
Solution:   Update redo buffer before calling ml_replace().

diff --git a/src/spellsuggest.c b/src/spellsuggest.c
index c03233f52ef997f1d2a18c2f75fe36df92610382..6f9a756984455fd2595b69bfaf3d640a964978ec 100644 (file)
--- a/src/spellsuggest.c
+++ b/src/spellsuggest.c
@@ -676,8 +676,6 @@ spell_suggest(int count)
            mch_memmove(p, line, c);
            STRCPY(p + c, stp->st_word);
            STRCAT(p, sug.su_badptr + stp->st_orglen);
-           ml_replace(curwin->w_cursor.lnum, p, FALSE);
-           curwin->w_cursor.col = c;
 
            // For redo we use a change-word command.
            ResetRedobuff();
@@ -686,7 +684,10 @@ spell_suggest(int count)
                            stp->st_wordlen + sug.su_badlen - stp->st_orglen);
            AppendCharToRedobuff(ESC);
 
-           // After this "p" may be invalid.
+           // "p" may be freed here
+           ml_replace(curwin->w_cursor.lnum, p, FALSE);
+           curwin->w_cursor.col = c;
+
            changed_bytes(curwin->w_cursor.lnum, c);
        }
     }

diff --git a/src/version.c b/src/version.c
index 83f5c2efe5555940cf782d09f42f75a09676b2fc..4406488bbd186a022e463daa96175294852a3304 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -754,6 +754,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1095,
 /**/
     1094,
 /**/