patch 8.0.0085

Problem:    Using freed memory with recursive function call. (Dominique Pelle)
Solution:   Make a copy of the function name.

diff --git a/src/eval.c b/src/eval.c
index e92a97f1860066f08fac316db2d95e3874e3d526..7ca129b378833486348b27184345040c1dbda948 100644 (file)
--- a/src/eval.c
+++ b/src/eval.c
@@ -4339,10 +4339,17 @@ eval7(
                 * use its contents. */
                s = deref_func_name(s, &len, &partial, !evaluate);
 
-               /* Invoke the function. */
-               ret = get_func_tv(s, len, rettv, arg,
-                         curwin->w_cursor.lnum, curwin->w_cursor.lnum,
-                         &len, evaluate, partial, NULL);
+               /* Need to make a copy, in case evaluating the arguments makes
+                * the name invalid. */
+               s = vim_strsave(s);
+               if (s == NULL)
+                   ret = FAIL;
+               else
+                   /* Invoke the function. */
+                   ret = get_func_tv(s, len, rettv, arg,
+                             curwin->w_cursor.lnum, curwin->w_cursor.lnum,
+                             &len, evaluate, partial, NULL);
+               vim_free(s);
 
                /* If evaluate is FALSE rettv->v_type was not set in
                 * get_func_tv, but it's needed in handle_subscript() to parse

diff --git a/src/testdir/test_nested_function.vim b/src/testdir/test_nested_function.vim
index f881730529db4029a7d4577303e26bc64732dadc..7e301ed33e4aec88443ab3004abe5f989da9e57c 100644 (file)
--- a/src/testdir/test_nested_function.vim
+++ b/src/testdir/test_nested_function.vim
@@ -1,32 +1,42 @@
 "Tests for nested functions
 "
-function! NestedFunc()
-  fu! Func1()
+func NestedFunc()
+  func! Func1()
     let g:text .= 'Func1 '
-  endfunction
+  endfunc
   call Func1()
-  fu! s:func2()
+  func! s:func2()
     let g:text .= 's:func2 '
-  endfunction
+  endfunc
   call s:func2()
-  fu! s:_func3()
+  func! s:_func3()
     let g:text .= 's:_func3 '
-  endfunction
+  endfunc
   call s:_func3()
   let fn = 'Func4'
-  fu! {fn}()
+  func! {fn}()
     let g:text .= 'Func4 '
-  endfunction
+  endfunc
   call {fn}()
   let fn = 'func5'
-  fu! s:{fn}()
+  func! s:{fn}()
     let g:text .= 's:func5'
-  endfunction
+  endfunc
   call s:{fn}()
-endfunction
+endfunc
 
-function! Test_nested_functions()
+func Test_nested_functions()
   let g:text = ''
   call NestedFunc()
   call assert_equal('Func1 s:func2 s:_func3 Func4 s:func5', g:text)
 endfunction
+
+func Test_nested_argument()
+  func g:X()
+    let g:Y = function('sort')
+  endfunc
+  let g:Y = function('sort')
+  echo g:Y([], g:X())
+  delfunc g:X
+  unlet g:Y
+endfunc

diff --git a/src/version.c b/src/version.c
index c4013e790c82e14c976877f1564b99ba1191fedb..8b30bae903a19ed726b140e68e247ca890766f2d 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -764,6 +764,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    85,
 /**/
     84,
 /**/