neovim

commit 47d9a393de766d8e444043f5bc40dc774d45fece
parent 7f6d2984a86784c1a11a9f86ce827dbc7f648f28
Author: James McCoy <jamessan@jamessan.com>
Date:   Sun, 22 May 2022 13:29:15 -0400

fix(cid/352839): USE_AFTER_FREE in create_user_command #18669


Diffstat:
M
src/nvim/api/private/helpers.c
 | 
2
+-
M
src/nvim/ex_docmd.c
 | 
5
+++++

2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/nvim/api/private/helpers.c b/src/nvim/api/private/helpers.c
@@ -1616,7 +1616,7 @@ void create_user_command(String name, Object command, Dict(user_command) *opts, 
   if (uc_add_command(name.data, name.size, rep, argt, def, flags, compl, compl_arg, compl_luaref,
                      addr_type_arg, luaref, force) != OK) {
     api_set_error(err, kErrorTypeException, "Failed to create user command");
-    goto err;
+    // Do not goto err, since uc_add_command now owns luaref, compl_luaref, and compl_arg
   }
 
   return;
diff --git a/src/nvim/ex_docmd.c b/src/nvim/ex_docmd.c
@@ -5528,6 +5528,11 @@ char *uc_validate_name(char *name)
   return name;
 }
 
+/// Create a new user command {name}, if one doesn't already exist.
+///
+/// This function takes ownership of compl_arg, compl_luaref, and luaref.
+///
+/// @return  OK if the command is created, FAIL otherwise.
 int uc_add_command(char *name, size_t name_len, char *rep, uint32_t argt, long def, int flags,
                    int compl, char *compl_arg, LuaRef compl_luaref, cmd_addr_T addr_type,
                    LuaRef luaref, bool force)