To: vim_dev@googlegroups.com
Subject: Patch 8.2.1825
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 8.2.1825
Problem:    Vim9: accessing freed memory.
Solution:   Clear sv_name when the variable is deleted.
Files:      src/ex_eval.c


*** ../vim-8.2.1824/src/ex_eval.c	2020-10-10 19:07:04.187713866 +0200
--- src/ex_eval.c	2020-10-10 20:25:24.729749252 +0200
***************
*** 925,946 ****
  
      if (in_vim9script())
      {
! 	scriptitem_T *si = SCRIPT_ITEM(current_sctx.sc_sid);
  
! 	for (i = cstack->cs_script_var_len[cstack->cs_idx];
! 					       i < si->sn_var_vals.ga_len; ++i)
  	{
! 	    svar_T	*sv = ((svar_T *)si->sn_var_vals.ga_data) + i;
! 	    hashtab_T	*ht = get_script_local_ht();
! 	    hashitem_T	*hi;
! 
! 	    if (ht != NULL)
  	    {
! 		// Remove a variable declared inside the block, if it still
! 		// exists.
! 		hi = hash_find(ht, sv->sv_name);
! 		if (!HASHITEM_EMPTY(hi))
! 		    delete_var(ht, hi);
  	    }
  	}
      }
--- 925,952 ----
  
      if (in_vim9script())
      {
! 	scriptitem_T	*si = SCRIPT_ITEM(current_sctx.sc_sid);
! 	hashtab_T	*ht = get_script_local_ht();
  
! 	if (ht != NULL)
  	{
! 	    for (i = cstack->cs_script_var_len[cstack->cs_idx];
! 					       i < si->sn_var_vals.ga_len; ++i)
  	    {
! 		svar_T	*sv = ((svar_T *)si->sn_var_vals.ga_data) + i;
! 		hashitem_T	*hi;
! 
! 		if (sv->sv_name != NULL)
! 		{
! 		    // Remove a variable declared inside the block, if it still
! 		    // exists.
! 		    hi = hash_find(ht, sv->sv_name);
! 		    if (!HASHITEM_EMPTY(hi))
! 		    {
! 			delete_var(ht, hi);
! 			sv->sv_name = NULL;
! 		    }
! 		}
  	    }
  	}
      }
*** ../vim-8.2.1824/src/version.c	2020-10-10 19:07:04.187713866 +0200
--- src/version.c	2020-10-10 19:21:37.537842834 +0200
***************
*** 752,753 ****
--- 752,755 ----
  {   /* Add new patch number below this line */
+ /**/
+     1825,
  /**/

-- 
Over the years, I've developed my sense of deja vu so acutely that now
I can remember things that *have* happened before ...

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\  an exciting new programming language -- http://www.Zimbu.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///