[vim/vim] patch 9.2.XXXX: double-free in string_reduce() (PR #21048)

Problem:  string_reduce() copies *rettv into argv[0] before calling
          eval_expr_typval().  When the evaluator fails early, rettv is never
          reset and still aliases argv[0]'s v_string.  clear_tv(&argv[0]) frees
          it, leaving rettv dangling. In vim9script get_func_tv() then frees it
          again.
Solution: Null out argv[0].vval.v_string before clearing it when it
          aliases rettv->vval.v_string.

Supported by AI
You can view, comment on, or merge this pull request online at:

  https://github.com/vim/vim/pull/21048

-- Commit Summary --

  * patch 9.2.XXXX: double-free in string_reduce()

-- File Changes --

    M src/strings.c (6)
    M src/testdir/test_listdict.vim (7)

-- Patch Links --

https://github.com/vim/vim/pull/21048.patch
https://github.com/vim/vim/pull/21048.diff

-- 
Reply to this email directly or view it on GitHub:
https://github.com/vim/vim/pull/21048
You are receiving this because you are subscribed to this thread.

Message ID: <vim/vim/pull/[email protected]>

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups "vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/d/msgid/vim_dev/vim/vim/pull/21048%40github.com.