From adce965162dd89bf29ee0e5baf53652e7515762c Mon Sep 17 00:00:00 2001 From: Bram Moolenaar Date: Mon, 22 Aug 2022 16:35:45 +0100 Subject: [PATCH] patch 9.0.0246: using freed memory when 'tagfunc' deletes the buffer Problem: Using freed memory when 'tagfunc' deletes the buffer. Solution: Make a copy of the tag name. --- src/tag.c | 9 ++++++++- src/testdir/test_tagfunc.vim | 12 ++++++++++++ 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/src/tag.c b/src/tag.c index c00f5fb..aceb6e4 100644 --- a/src/tag.c +++ b/src/tag.c @@ -161,6 +161,7 @@ do_tag( char_u *buf_ffname = curbuf->b_ffname; // name to use for // priority computation int use_tfu = 1; + char_u *tofree = NULL; // remember the matches for the last used tag static int num_matches = 0; @@ -510,7 +511,12 @@ do_tag( * When desired match not found yet, try to find it (and others). */ if (use_tagstack) - name = tagstack[tagstackidx].tagname; + { + // make a copy, the tagstack may change in 'tagfunc' + name = vim_strsave(tagstack[tagstackidx].tagname); + vim_free(tofree); + tofree = name; + } #if defined(FEAT_QUICKFIX) else if (g_do_tagpreview != 0) name = ptag_entry.tagname; @@ -802,6 +808,7 @@ end_do_tag: g_do_tagpreview = 0; // don't do tag preview next time # endif + vim_free(tofree); #ifdef FEAT_CSCOPE return jumped_to_tag; #else diff --git a/src/testdir/test_tagfunc.vim b/src/testdir/test_tagfunc.vim index 242aa3a..74ad3d1 100644 --- a/src/testdir/test_tagfunc.vim +++ b/src/testdir/test_tagfunc.vim @@ -81,4 +81,16 @@ func Test_tagfunc() call delete('Xfile1') endfunc +func Test_tagfunc_wipes_buffer() + func g:Tag0unc0(t,f,o) + bwipe + endfunc + set tagfunc=g:Tag0unc0 + new + cal assert_fails('tag 0', 'E426:') + + delfunc g:Tag0unc0 + set tagfunc= +endfunc + " vim: shiftwidth=2 sts=2 expandtab -- 2.27.0