patch 8.2.2463: using :arglocal in an autocommand may use freed memory

Problem:    Using :arglocal in an autocommand may use freed memory.
            (houyunsong)
Solution:   Check if the arglist is locked.

diff --git a/src/arglist.c b/src/arglist.c
index 503cbd90df94bfa21bb3b8275dc51990335e7923..79628fda62c3ca038d0f56bd906d1335140b5c65 100644 (file)
--- a/src/arglist.c
+++ b/src/arglist.c
@@ -557,6 +557,8 @@ ex_args(exarg_T *eap)
 
     if (eap->cmdidx != CMD_args)
     {
+       if (check_arglist_locked() == FAIL)
+           return;
        alist_unlink(ALIST(curwin));
        if (eap->cmdidx == CMD_argglobal)
            ALIST(curwin) = &global_alist;
@@ -566,6 +568,8 @@ ex_args(exarg_T *eap)
 
     if (*eap->arg != NUL)
     {
+       if (check_arglist_locked() == FAIL)
+           return;
        // ":args file ..": define new argument list, handle like ":next"
        // Also for ":argslocal file .." and ":argsglobal file ..".
        ex_next(eap);

diff --git a/src/testdir/test_autocmd.vim b/src/testdir/test_autocmd.vim
index dab699155ce4d927efbee7d74aabace666a24a1d..71f8d2d60ce4d6fd97c23549c55fbe9f2a64f715 100644 (file)
--- a/src/testdir/test_autocmd.vim
+++ b/src/testdir/test_autocmd.vim
@@ -2717,4 +2717,13 @@ func Test_close_autocmd_tab()
   %bwipe!
 endfunc
 
+" This was using freed memory.
+func Test_BufNew_arglocal()
+  arglocal
+  au BufNew * arglocal
+  call assert_fails('drop xx', 'E1156:')
+
+  au! BufNew
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index a7288f38524581e5f960e149269527e461f5bbef..53ed13c73a833df04e286d774863911714ea5245 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2463,
 /**/
     2462,
 /**/