patch 9.2.0618: use-after-free in popup_getoptions() on dict_add() failure
Commit:
https://github.com/vim/vim/commit/f202f6ca95220cd7915e80bb8d81e0e70082faaa
Author: Yasuhiro Matsumoto <[email protected]>
Date: Wed Jun 10 20:55:06 2026 +0000
patch 9.2.0618: use-after-free in popup_getoptions() on dict_add() failure
Problem: use-after-free in popup_getoptions() on dict_add() failure
Solution: Set b to NULL (Yasuhiro Matsumoto).
When dict_add() failed, dictitem_free() unref'd and freed the blob, but
the error cleanup then read the freed blob's refcount and could free it
again. Clear the pointer after dictitem_free().
closes: #20464
Signed-off-by: Yasuhiro Matsumoto <[email protected]>
Signed-off-by: Christian Brabandt <[email protected]>
diff --git a/src/popupwin.c b/src/popupwin.c
index 7610ae538..351c86556 100644
--- a/src/popupwin.c
+++ b/src/popupwin.c
@@ -5433,7 +5433,9 @@ f_popup_getoptions(typval_T *argvars, typval_T *rettv)
++b->bv_refcount;
if (dict_add(idict, item) == FAIL)
{
+ // dictitem_free() already freed the blob
dictitem_free(item);
+ b = NULL;
ok = FALSE;
}
}
diff --git a/src/version.c b/src/version.c
index e100c8a4b..8d6afb613 100644
--- a/src/version.c
+++ b/src/version.c
@@ -754,6 +754,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 618,
/**/
617,
/**/
--
--
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php
---
You received this message because you are subscribed to the Google Groups
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/vim_dev/E1wXQ1u-008UdM-MK%40256bit.org.
