patch 9.2.0567: dict function name allocation failure not handled

thinca · claude · chrisbra · commit 2b2dfc4f5a60 · 2026-05-30T18:40:55.000Z
Problem:  When defining a dictionary function, the function name string
          is allocated with vim_strnsave() but the result is not
          checked. On allocation failure the dict entry is left with
          type VAR_FUNC and a NULL name, and in the overwrite case the
          previous entry has already been freed before the NULL is
          stored.
Solution: Allocate the name before modifying the dict entry and bail out
          on failure, freeing it on all error paths (thinca)

closes: #20376

Co-Authored-by: Claude &lt;noreply@anthropic.com&gt;
Signed-off-by: thinca &lt;thinca@gmail.com&gt;
Signed-off-by: Christian Brabandt &lt;cb@256bit.org&gt;
diff --git a/src/userfunc.c b/src/userfunc.c
@@ -5612,18 +5612,27 @@ define_function(
 
 	if (fudi.fd_dict != NULL)
 	{
+	    char_u *func_name = vim_strnsave(name, namelen);
+
+	    if (func_name == NULL)
+	    {
+		VIM_CLEAR(fp);
+		goto erret;
+	    }
 	    if (fudi.fd_di == NULL)
 	    {
 		// add new dict entry
 		fudi.fd_di = dictitem_alloc(fudi.fd_newkey);
 		if (fudi.fd_di == NULL)
 		{
+		    vim_free(func_name);
 		    VIM_CLEAR(fp);
 		    goto erret;
 		}
 		if (dict_add(fudi.fd_dict, fudi.fd_di) == FAIL)
 		{
 		    vim_free(fudi.fd_di);
+		    vim_free(func_name);
 		    VIM_CLEAR(fp);
 		    goto erret;
 		}
@@ -5632,7 +5641,7 @@ define_function(
 		// overwrite existing dict entry
 		clear_tv(&fudi.fd_di->di_tv);
 	    fudi.fd_di->di_tv.v_type = VAR_FUNC;
-	    fudi.fd_di->di_tv.vval.v_string = vim_strnsave(name, namelen);
+	    fudi.fd_di->di_tv.vval.v_string = func_name;
 
 	    // behave like "dict" was used
 	    flags |= FC_DICT;
diff --git a/src/version.c b/src/version.c
@@ -729,6 +729,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    567,
 /**/
     566,
 /**/

Original file line number	Diff line number	Diff line change
`@@ -5612,18 +5612,27 @@ define_function(`
`5612`	`5612`
`5613`	`5613`	`if (fudi.fd_dict != NULL)`
`5614`	`5614`	`{`
	`5615`	`+ char_u *func_name = vim_strnsave(name, namelen);`
	`5616`	`+`
	`5617`	`+ if (func_name == NULL)`
	`5618`	`+ {`
	`5619`	`+ VIM_CLEAR(fp);`
	`5620`	`+ goto erret;`
	`5621`	`+ }`
`5615`	`5622`	`if (fudi.fd_di == NULL)`
`5616`	`5623`	`{`
`5617`	`5624`	`// add new dict entry`
`5618`	`5625`	`fudi.fd_di = dictitem_alloc(fudi.fd_newkey);`
`5619`	`5626`	`if (fudi.fd_di == NULL)`
`5620`	`5627`	`{`
	`5628`	`+ vim_free(func_name);`
`5621`	`5629`	`VIM_CLEAR(fp);`
`5622`	`5630`	`goto erret;`
`5623`	`5631`	`}`
`5624`	`5632`	`if (dict_add(fudi.fd_dict, fudi.fd_di) == FAIL)`
`5625`	`5633`	`{`
`5626`	`5634`	`vim_free(fudi.fd_di);`
	`5635`	`+ vim_free(func_name);`
`5627`	`5636`	`VIM_CLEAR(fp);`
`5628`	`5637`	`goto erret;`
`5629`	`5638`	`}`
`@@ -5632,7 +5641,7 @@ define_function(`
`5632`	`5641`	`// overwrite existing dict entry`
`5633`	`5642`	`clear_tv(&fudi.fd_di->di_tv);`
`5634`	`5643`	`fudi.fd_di->di_tv.v_type = VAR_FUNC;`
`5635`		`- fudi.fd_di->di_tv.vval.v_string = vim_strnsave(name, namelen);`
	`5644`	`+ fudi.fd_di->di_tv.vval.v_string = func_name;`
`5636`	`5645`
`5637`	`5646`	`// behave like "dict" was used`
`5638`	`5647`	`flags \|= FC_DICT;`