patch 7.4.2327

Problem:    Freeing a variable that is on the stack.
Solution:   Don't free res_tv or err_tv. (Ozaki Kiichi)

diff --git a/src/channel.c b/src/channel.c
index bbe98be1b22daca6e518c8a6213c5bb0d5c38c23..10ed42e6b7e014f28fa1cbd23c97a08f6c4b6073 100644 (file)
--- a/src/channel.c
+++ b/src/channel.c
@@ -2142,7 +2142,7 @@ channel_exe_cmd(channel_T *channel, int part, typval_T *argv)
        }
        else
        {
-           typval_T    *tv;
+           typval_T    *tv = NULL;
            typval_T    res_tv;
            typval_T    err_tv;
            char_u      *json = NULL;
@@ -2159,8 +2159,6 @@ channel_exe_cmd(channel_T *channel, int part, typval_T *argv)
                ch_logs(channel, "Calling '%s'", (char *)arg);
                if (func_call(arg, &argv[2], NULL, NULL, &res_tv) == OK)
                    tv = &res_tv;
-               else
-                   tv = NULL;
            }
 
            if (argv[id_idx].v_type == VAR_NUMBER)
@@ -2174,11 +2172,9 @@ channel_exe_cmd(channel_T *channel, int part, typval_T *argv)
                    /* If evaluation failed or the result can't be encoded
                     * then return the string "ERROR". */
                    vim_free(json);
-                   free_tv(tv);
                    err_tv.v_type = VAR_STRING;
                    err_tv.vval.v_string = (char_u *)"ERROR";
-                   tv = &err_tv;
-                   json = json_encode_nr_expr(id, tv, options | JSON_NL);
+                   json = json_encode_nr_expr(id, &err_tv, options | JSON_NL);
                }
                if (json != NULL)
                {
@@ -2191,7 +2187,7 @@ channel_exe_cmd(channel_T *channel, int part, typval_T *argv)
            --emsg_skip;
            if (tv == &res_tv)
                clear_tv(tv);
-           else if (tv != &err_tv)
+           else
                free_tv(tv);
        }
     }

diff --git a/src/version.c b/src/version.c
index 06fb3ef5527410c869479c9f7ba1c90d1ba91f84..4ab697b9ba386d2d161e84cef19d47a283b51abd 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -763,6 +763,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2327,
 /**/
     2326,
 /**/