Re: PATCH: fix a memory leak and potential heap corruption when rotating lines

[Roman Perepelitsa <roman.perepelitsa@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 283 bytes --]

On Mon, Oct 28, 2019 at 12:50 PM Mikael Magnusson <mikachu@gmail.com> wrote:
> Did you accidentally sent a reversed patch?

Oops. Yes, I did.

I'm attaching the proper patch. Link to the same:
https://github.com/zsh-users/zsh/commit/1edb4d235da56e785f85cdc111efdfb9b0753163.

Roman.

[-- Attachment #2: fix-rotate-lines.patch.txt --]
[-- Type: text/plain, Size: 793 bytes --]

diff --git a/Src/Zle/zle_refresh.c b/Src/Zle/zle_refresh.c
index 85e55e0d4..7cc338ab1 100644
--- a/Src/Zle/zle_refresh.c
+++ b/Src/Zle/zle_refresh.c
@@ -1652,7 +1652,7 @@ zrefresh(void)
 		zfree(obuf[iln], (winw + 2) * sizeof(**obuf));
 		for (t0 = iln; t0 != olnct; t0++)
 		    obuf[t0] = obuf[t0 + 1];
-		obuf[--olnct] = NULL;
+		obuf[olnct--] = NULL;
 	    }
 	/* don't try to insert a line if olnct = vmaxln (vmaxln is the number
 	   of lines that have been displayed by this routine) so that we don't
@@ -1662,6 +1662,7 @@ zrefresh(void)
 		     obuf[iln] && !ZR_strncmp(obuf[iln], nbuf[iln + 1], 16)) {
 		moveto(iln, 0);
 		tcout(TCINSLINE);
+		zfree(obuf[olnct], (winw + 2) * sizeof(**obuf));
 		for (t0 = olnct; t0 != iln; t0--)
 		    obuf[t0] = obuf[t0 - 1];
 		obuf[iln] = NULL;