From: Bram Moolenaar <Bram@vim.org>
Date: Thu, 25 Nov 2021 14:43:18 +0000 (+0000)
Subject: patch 8.2.3675: using freed memory when vim_strsave() fails
X-Git-Tag: v8.2.3675
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=ba8c92687d53c91bbc20c867a49e0988819ea2d5;p=vim

patch 8.2.3675: using freed memory when vim_strsave() fails

Problem:    Using freed memory when vim_strsave() fails.
Solution:   Clear "last_sourcing_name".  Check for msg_source() called
            recursively. (closes #8217)
---

diff --git a/src/message.c b/src/message.c
index e438211fa..8992de013 100644
--- a/src/message.c
+++ b/src/message.c
@@ -522,6 +522,12 @@ get_emsg_lnum(void)
 msg_source(int attr)
 {
     char_u	*p;
+    static int	recursive = FALSE;
+
+    // Bail out if something called here causes an error.
+    if (recursive)
+	return;
+    recursive = TRUE;
 
     ++no_wait_return;
     p = get_emsg_source();
@@ -541,13 +547,13 @@ msg_source(int attr)
     // remember the last sourcing name printed, also when it's empty
     if (SOURCING_NAME == NULL || other_sourcing_name())
     {
-	vim_free(last_sourcing_name);
-	if (SOURCING_NAME == NULL)
-	    last_sourcing_name = NULL;
-	else
+	VIM_CLEAR(last_sourcing_name);
+	if (SOURCING_NAME != NULL)
 	    last_sourcing_name = vim_strsave(SOURCING_NAME);
     }
     --no_wait_return;
+
+    recursive = FALSE;
 }
 
 /*
diff --git a/src/version.c b/src/version.c
index 6d96d4324..07d93d98b 100644
--- a/src/version.c
+++ b/src/version.c
@@ -757,6 +757,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    3675,
 /**/
     3674,
 /**/