patch 9.0.0246: using freed memory when 'tagfunc' deletes the buffer

Problem:    Using freed memory when 'tagfunc' deletes the buffer.
Solution:   Make a copy of the tag name.

diff --git a/src/tag.c b/src/tag.c
index 8a351cc0580a0b1e9f7aa4df1019fc60d6a71b18..02f0818fec55ad42bbe84419ebfeb1cecc8efa52 100644 (file)
--- a/src/tag.c
+++ b/src/tag.c
@@ -281,6 +281,7 @@ do_tag(
     char_u     *buf_ffname = curbuf->b_ffname;     // name to use for
                                                    // priority computation
     int                use_tfu = 1;
+    char_u     *tofree = NULL;
 
     // remember the matches for the last used tag
     static int         num_matches = 0;
@@ -630,7 +631,12 @@ do_tag(
         * When desired match not found yet, try to find it (and others).
         */
        if (use_tagstack)
-           name = tagstack[tagstackidx].tagname;
+       {
+           // make a copy, the tagstack may change in 'tagfunc'
+           name = vim_strsave(tagstack[tagstackidx].tagname);
+           vim_free(tofree);
+           tofree = name;
+       }
 #if defined(FEAT_QUICKFIX)
        else if (g_do_tagpreview != 0)
            name = ptag_entry.tagname;
@@ -922,6 +928,7 @@ end_do_tag:
     g_do_tagpreview = 0;       // don't do tag preview next time
 # endif
 
+    vim_free(tofree);
 #ifdef FEAT_CSCOPE
     return jumped_to_tag;
 #else

diff --git a/src/testdir/test_tagfunc.vim b/src/testdir/test_tagfunc.vim
index 05d8473cfb798b5b863f5c7305408fc673c9603b..95826121cd8499985c7081e383d8841912c0ee3f 100644 (file)
--- a/src/testdir/test_tagfunc.vim
+++ b/src/testdir/test_tagfunc.vim
@@ -389,4 +389,16 @@ func Test_tagfunc_callback()
   %bw!
 endfunc
 
+func Test_tagfunc_wipes_buffer()
+  func g:Tag0unc0(t,f,o)
+   bwipe
+  endfunc
+  set tagfunc=g:Tag0unc0
+  new
+  cal assert_fails('tag 0', 'E987:')
+
+  delfunc g:Tag0unc0
+  set tagfunc=
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index ec381fef2dc7662abc59884ef529cf84618ecabd..ec1302df04549c7c8c9f9c2ca226ef493d52c79a 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -731,6 +731,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    246,
 /**/
     245,
 /**/