patch 8.2.3427: double free when list is copied

Problem:    Double free when list is copied.
Solution:   Allocate the type when making a copy. (closes #8862)
            Clear the type for flattennew().  Avoid a memory leak when
            flattennew() fails.

diff --git a/src/list.c b/src/list.c
index 336bf3ba76d5416b11f115619f71503cd3b382bd..8e67a61db3f81fadcd66f00430ff6e6b7b37bc17 100644 (file)
--- a/src/list.c
+++ b/src/list.c
@@ -952,7 +952,10 @@ list_flatten(list_T *list, long maxdepth)
 
            vimlist_remove(list, item, item);
            if (list_extend(list, item->li_tv.vval.v_list, next) == FAIL)
+           {
+               list_free_item(list, item);
                return;
+           }
            clear_tv(&item->li_tv);
            tofree = item;
 
@@ -1023,6 +1026,9 @@ flatten_common(typval_T *argvars, typval_T *rettv, int make_copy)
        rettv->vval.v_list = l;
        if (l == NULL)
            return;
+       // The type will change.
+       free_type(l->lv_type);
+       l->lv_type = NULL;
     }
     else
     {
@@ -1217,7 +1223,7 @@ list_copy(list_T *orig, int deep, int copyID)
     copy = list_alloc();
     if (copy != NULL)
     {
-       copy->lv_type = orig->lv_type;
+       copy->lv_type = alloc_type(orig->lv_type);
        if (copyID != 0)
        {
            // Do this before adding the items, because one of the items may

diff --git a/src/testdir/test_vim9_builtin.vim b/src/testdir/test_vim9_builtin.vim
index 95d4e4d858ac32a6710ddf197a3dddb22e2f4ffa..5f22b333d6691e2de427c104852dc2ecd527a675 100644 (file)
--- a/src/testdir/test_vim9_builtin.vim
+++ b/src/testdir/test_vim9_builtin.vim
@@ -1090,6 +1090,13 @@ def Test_findfile()
   CheckDefAndScriptFailure2(['findfile("a", "b", "c")'], 'E1013: Argument 3: type mismatch, expected number but got string', 'E1210: Number required for argument 3')
 enddef
 
+def Test_flatten()
+  var lines =<< trim END
+      echo flatten([1, 2, 3])
+  END
+  CheckDefAndScriptFailure(lines, 'E1158:')
+enddef
+
 def Test_flattennew()
   var lines =<< trim END
       var l = [1, [2, [3, 4]], 5]
@@ -1098,13 +1105,12 @@ def Test_flattennew()
 
       call assert_equal([1, 2, [3, 4], 5], flattennew(l, 1))
       call assert_equal([1, [2, [3, 4]], 5], l)
+
+      var ll: list<list<string>> = [['a', 'b', 'c']]
+      assert_equal(['a', 'b', 'c'], ll->flattennew())
   END
   CheckDefAndScriptSuccess(lines)
 
-  lines =<< trim END
-      echo flatten([1, 2, 3])
-  END
-  CheckDefAndScriptFailure(lines, 'E1158:')
   CheckDefAndScriptFailure2(['flattennew({})'], 'E1013: Argument 1: type mismatch, expected list<any> but got dict<unknown>', 'E1211: List required for argument 1')
   CheckDefAndScriptFailure2(['flattennew([], "1")'], 'E1013: Argument 2: type mismatch, expected number but got string', 'E1210: Number required for argument 2')
 enddef

diff --git a/src/version.c b/src/version.c
index c98249b94f764929e577733c329f584ade71ca0c..f82881fc06975e1b000c51e0e18e3c07b934178f 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -755,6 +755,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    3427,
 /**/
     3426,
 /**/