To: vim_dev@googlegroups.com
Subject: Patch 8.2.3779
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 8.2.3779
Problem:    Using freed memory when defining a user command from a user
            command.
Solution:   Do not use the command pointer after executing the command.
            (closes #9318)
Files:      src/usercmd.c, src/testdir/test_usercommands.vim


*** ../vim-8.2.3778/src/usercmd.c	2021-12-04 11:56:30.352101259 +0000
--- src/usercmd.c	2021-12-10 21:44:34.272071740 +0000
***************
*** 1670,1676 ****
      size_t	split_len = 0;
      char_u	*split_buf = NULL;
      ucmd_T	*cmd;
!     sctx_T	save_current_sctx = current_sctx;
  
      if (eap->cmdidx == CMD_USER)
  	cmd = USER_CMD(eap->useridx);
--- 1670,1677 ----
      size_t	split_len = 0;
      char_u	*split_buf = NULL;
      ucmd_T	*cmd;
!     sctx_T	save_current_sctx;
!     int		restore_current_sctx = FALSE;
  
      if (eap->cmdidx == CMD_USER)
  	cmd = USER_CMD(eap->useridx);
***************
*** 1771,1784 ****
  
      if ((cmd->uc_argt & EX_KEEPSCRIPT) == 0)
      {
  	current_sctx.sc_version = cmd->uc_script_ctx.sc_version;
  #ifdef FEAT_EVAL
  	current_sctx.sc_sid = cmd->uc_script_ctx.sc_sid;
  #endif
      }
      (void)do_cmdline(buf, eap->getline, eap->cookie,
  				   DOCMD_VERBOSE|DOCMD_NOWAIT|DOCMD_KEYTYPED);
!     if ((cmd->uc_argt & EX_KEEPSCRIPT) == 0)
  	current_sctx = save_current_sctx;
      vim_free(buf);
      vim_free(split_buf);
--- 1772,1791 ----
  
      if ((cmd->uc_argt & EX_KEEPSCRIPT) == 0)
      {
+ 	restore_current_sctx = TRUE;
+ 	save_current_sctx = current_sctx;
  	current_sctx.sc_version = cmd->uc_script_ctx.sc_version;
  #ifdef FEAT_EVAL
  	current_sctx.sc_sid = cmd->uc_script_ctx.sc_sid;
  #endif
      }
+ 
      (void)do_cmdline(buf, eap->getline, eap->cookie,
  				   DOCMD_VERBOSE|DOCMD_NOWAIT|DOCMD_KEYTYPED);
! 
!     // Careful: Do not use "cmd" here, it may have become invalid if a user
!     // command was added.
!     if (restore_current_sctx)
  	current_sctx = save_current_sctx;
      vim_free(buf);
      vim_free(split_buf);
*** ../vim-8.2.3778/src/testdir/test_usercommands.vim	2021-11-29 12:12:38.175653429 +0000
--- src/testdir/test_usercommands.vim	2021-12-10 21:43:39.528127021 +0000
***************
*** 704,708 ****
--- 704,727 ----
    delcommand GetCount
  enddef
  
+ func DefCmd(name)
+   if len(a:name) > 30
+     return
+   endif
+   exe 'command ' .. a:name .. ' call DefCmd("' .. a:name .. 'x")'
+   echo a:name
+   exe a:name
+ endfunc
+ 
+ func Test_recursive_define()
+   call DefCmd('Command')
+ 
+   let name = 'Command'
+   while len(name) < 30
+     exe 'delcommand ' .. name
+     let name ..= 'x'
+   endwhile
+ endfunc
+ 
  
  " vim: shiftwidth=2 sts=2 expandtab
*** ../vim-8.2.3778/src/version.c	2021-12-10 21:05:50.205426652 +0000
--- src/version.c	2021-12-10 21:45:19.728025775 +0000
***************
*** 755,756 ****
--- 755,758 ----
  {   /* Add new patch number below this line */
+ /**/
+     3779,
  /**/

-- 
How To Keep A Healthy Level Of Insanity:
1. At lunch time, sit in your parked car with sunglasses on and point
   a hair dryer at passing cars. See if they slow down.

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///                                                                      \\\
\\\        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///