To: vim-dev@vim.org
Subject: Patch 6.3b.014
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
------------

Patch 6.3b.014
Problem:    ":runtime! foo*.vim" may using freed memory when a sourced script
	    changes the value of 'runtimepath'.
Solution:   Make a copy of 'runtimepath' when looping over the matches.
Files:	    src/ex_cmds2.c


*** ../vim-6.3b.013/src/ex_cmds2.c	Sun May 16 22:38:45 2004
--- src/ex_cmds2.c	Fri May 28 12:53:58 2004
***************
*** 1877,1882 ****
--- 1877,1883 ----
      char_u	*rtp;
      char_u	*np;
      char_u	*buf;
+     char_u	*rtp_copy;
      char_u	*tail;
      int		num_files;
      char_u	**files;
***************
*** 1890,1903 ****
      proc->pr_WindowPtr = (APTR)-1L;
  #endif
  
      buf = alloc(MAXPATHL);
!     if (buf != NULL)
      {
  	if (p_verbose > 1)
  	    smsg((char_u *)_("Searching for \"%s\" in \"%s\""),
  						 (char *)name, (char *)p_rtp);
  	/* Loop over all entries in 'runtimepath'. */
! 	rtp = p_rtp;
  	while (*rtp != NUL && (all || !did_one))
  	{
  	    /* Copy the path from 'runtimepath' to buf[]. */
--- 1891,1907 ----
      proc->pr_WindowPtr = (APTR)-1L;
  #endif
  
+     /* Make a copy of 'runtimepath'.  Invoking the callback may change the
+      * value. */
+     rtp_copy = vim_strsave(p_rtp);
      buf = alloc(MAXPATHL);
!     if (buf != NULL && rtp_copy != NULL)
      {
  	if (p_verbose > 1)
  	    smsg((char_u *)_("Searching for \"%s\" in \"%s\""),
  						 (char *)name, (char *)p_rtp);
  	/* Loop over all entries in 'runtimepath'. */
! 	rtp = rtp_copy;
  	while (*rtp != NUL && (all || !did_one))
  	{
  	    /* Copy the path from 'runtimepath' to buf[]. */
***************
*** 1934,1941 ****
  		}
  	    }
  	}
- 	vim_free(buf);
      }
      if (p_verbose > 0 && !did_one)
  	msg_str((char_u *)_("not found in 'runtimepath': \"%s\""), name);
  
--- 1938,1946 ----
  		}
  	    }
  	}
      }
+     vim_free(buf);
+     vim_free(rtp_copy);
      if (p_verbose > 0 && !did_one)
  	msg_str((char_u *)_("not found in 'runtimepath': \"%s\""), name);
  
*** ../vim-6.3b.013/src/version.c	Sun May 30 20:23:42 2004
--- src/version.c	Sun May 30 20:28:38 2004
***************
*** 643,644 ****
--- 643,646 ----
  {   /* Add new patch number below this line */
+ /**/
+     14,
  /**/

-- 
hundred-and-one symptoms of being an internet addict:
4. Your eyeglasses have a web site burned in on them.

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        Sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\              Project leader for A-A-P -- http://www.A-A-P.org        ///
 \\\  Buy at Amazon and help AIDS victims -- http://ICCF.nl/click1.html ///