From a929c922b1cb7c84ad1b5d1d0fc9a4f7c68ab8e0 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Mon, 18 Apr 2022 15:21:17 +0100
Subject: [PATCH] patch 8.2.4782: accessing freed memory

Problem:    Accessing freed memory.
Solution:   Clear evalarg after checking for trailing characters.
            (issue #10218)
---
 src/testdir/test_lambda.vim | 16 ++++++++++++++++
 src/userfunc.c              |  3 ++-
 src/version.c               |  2 ++
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/src/testdir/test_lambda.vim b/src/testdir/test_lambda.vim
index 8d06e5973..77266299e 100644
--- a/src/testdir/test_lambda.vim
+++ b/src/testdir/test_lambda.vim
@@ -1,6 +1,7 @@
 " Test for lambda and closure
 
 source check.vim
+import './vim9.vim' as v9
 
 func Test_lambda_feature()
   call assert_equal(1, has('lambda'))
@@ -54,6 +55,21 @@ func Test_lambda_with_timer()
   call assert_true(s:n > m)
 endfunc
 
+func Test_lambda_vim9cmd_linebreak()
+  CheckFeature timers
+
+  let lines =<< trim END
+      vim9cmd call timer_start(10, (x) => {
+          # comment
+          g:result = 'done'
+         })
+  END
+  call v9.CheckScriptSuccess(lines)
+  sleep 50m
+  call assert_equal('done', g:result)
+  unlet g:result
+endfunc
+
 func Test_lambda_with_partial()
   let l:Cb = function({... -> ['zero', a:1, a:2, a:3]}, ['one', 'two'])
   call assert_equal(['zero', 'one', 'two', 'three'], l:Cb('three'))
diff --git a/src/userfunc.c b/src/userfunc.c
index 155c4ff1c..f3ba7719c 100644
--- a/src/userfunc.c
+++ b/src/userfunc.c
@@ -5529,7 +5529,6 @@ ex_call(exarg_T *eap)
     }
     if (eap->skip)
 	--emsg_skip;
-    clear_evalarg(&evalarg, eap);
 
     // When inside :try we need to check for following "| catch" or "| endtry".
     // Not when there was an error, but do check if an exception was thrown.
@@ -5549,6 +5548,8 @@ ex_call(exarg_T *eap)
 	else
 	    set_nextcmd(eap, arg);
     }
+    // Must be after using "arg", it may point into memory cleared here.
+    clear_evalarg(&evalarg, eap);
 
 end:
     dict_unref(fudi.fd_dict);
diff --git a/src/version.c b/src/version.c
index eb05f8822..7f792d250 100644
--- a/src/version.c
+++ b/src/version.c
@@ -746,6 +746,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4782,
 /**/
     4781,
 /**/
-- 
2.50.1