neovim

commit 17c8e39f8803daa6f0e6106ce1c087240cef4771
parent 0a3a2132d43be3a376214f75157d4d2b1340311e
Author: zeertzjq <zeertzjq@outlook.com>
Date:   Thu,  4 May 2023 21:49:48 +0800

vim-patch:9.0.0213: using freed memory with error in assert argument

Problem:    Using freed memory with error in assert argument.
Solution:   Make a copy of the error.

https://github.com/vim/vim/commit/249e1b903a9c0460d618f6dcc59aeb8c03b24b20

Co-authored-by: Bram Moolenaar <Bram@vim.org>

Diffstat:
M
src/nvim/testing.c
 | 
5
++++-
M
test/old/testdir/test_assert.vim
 | 
4
++++

2 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/src/nvim/testing.c b/src/nvim/testing.c
@@ -510,6 +510,7 @@ void f_assert_fails(typval_T *argvars, typval_T *rettv, EvalFuncData fptr)
   const int save_trylevel = trylevel;
   const int called_emsg_before = called_emsg;
   const char *wrong_arg_msg = NULL;
+  char *tofree = NULL;
 
   if (tv_check_for_string_or_number_arg(argvars, 0) == FAIL
       || tv_check_for_opt_string_or_list_arg(argvars, 1) == FAIL
@@ -560,8 +561,9 @@ void f_assert_fails(typval_T *argvars, typval_T *rettv, EvalFuncData fptr)
         error_found = true;
         expected_str = expected;
       } else if (tv_list_len(list) == 2) {
+        // make a copy, an error in pattern_match() may free it
+        tofree = actual = xstrdup(get_vim_var_str(VV_ERRMSG));
         tv = TV_LIST_ITEM_TV(tv_list_last(list));
-        actual = get_vim_var_str(VV_ERRMSG);
         expected = tv_get_string_buf_chk(tv, buf);
         if (!pattern_match(expected, actual, false)) {
           error_found = true;
@@ -632,6 +634,7 @@ theend:
   msg_reset_scroll();
   lines_left = Rows;
   XFREE_CLEAR(emsg_assert_fails_msg);
+  xfree(tofree);
   set_vim_var_string(VV_ERRMSG, NULL, 0);
   if (wrong_arg_msg != NULL) {
     emsg(_(wrong_arg_msg));
diff --git a/test/old/testdir/test_assert.vim b/test/old/testdir/test_assert.vim
@@ -277,6 +277,10 @@ func Test_assert_fail_fails()
     let exp = v:exception
   endtry
   call assert_match("E1174: String required for argument 5", exp)
+
+  call assert_equal(1, assert_fails('c0', ['', '\1']))
+  call assert_match("Expected '\\\\\\\\1' but got 'E939: Positive count required: c0': c0", v:errors[0])
+  call remove(v:errors, 0)
 endfunc
 
 func Test_assert_fails_in_try_block()