neovim

commit ee717447dd7e7989b8d9026577a39a2ec2a0f703
parent 9cc93b6def0ca580731ad6097318f63912777026
Author: Jan Edmund Lazo <jan.lazo@mail.utoronto.ca>
Date:   Wed, 24 Dec 2025 00:50:29 -0500

vim-patch:9.1.1491: missing out-of-memory checks in cmdexpand.c

Problem:  missing out-of-memory checks in cmdexpand.c
Solution: add out-of-memory checks for expand_files_and_dirs(),
          ExpandUserDefined() and ExpandUserList()
          (John Marriott)

closes: vim/vim#17570

https://github.com/vim/vim/commit/3b03b435a29391ded301fa2f377141db3c8093b7

Co-authored-by: John Marriott <basilisk@internode.on.net>

Diffstat:
M
src/nvim/cmdexpand.c
 | 
9
++++++---

1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/src/nvim/cmdexpand.c b/src/nvim/cmdexpand.c
@@ -3472,12 +3472,14 @@ static int ExpandUserDefined(const char *const pat, expand_T *xp, regmatch_T *re
     *e = keep;
 
     if (match) {
+      char *p = xmemdupz(s, (size_t)(e - s));
+
       if (!fuzzy) {
-        GA_APPEND(char *, &ga, xmemdupz(s, (size_t)(e - s)));
+        GA_APPEND(char *, &ga, p);
       } else {
         GA_APPEND(fuzmatch_str_T, &ga, ((fuzmatch_str_T){
           .idx = ga.ga_len,
-          .str = xmemdupz(s, (size_t)(e - s)),
+          .str = p,
           .score = score,
         }));
       }
@@ -3521,8 +3523,9 @@ static int ExpandUserList(expand_T *xp, char ***matches, int *numMatches)
         || TV_LIST_ITEM_TV(li)->vval.v_string == NULL) {
       continue;  // Skip non-string items and empty strings.
     }
+    char *p = xstrdup(TV_LIST_ITEM_TV(li)->vval.v_string);
 
-    GA_APPEND(char *, &ga, xstrdup(TV_LIST_ITEM_TV(li)->vval.v_string));
+    GA_APPEND(char *, &ga, p);
   });
   tv_list_unref(retlist);