eval: Do not access list item after removing it

neovim · Feb 13, 2018 · d08ad17 · d08ad17
1 parent df23769
commit d08ad17
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 3 deletions.
diff --git a/src/nvim/eval.c b/src/nvim/eval.c
@@ -13298,9 +13298,7 @@ static void f_remove(typval_T *argvars, typval_T *rettv, FunPtr fptr)
     } else {
       if (argvars[2].v_type == VAR_UNKNOWN) {
         // Remove one item, return its value.
-        tv_list_drop_items(l, item, item);
-        *rettv = *TV_LIST_ITEM_TV(item);
-        xfree(item);
+        *rettv = tv_list_pop_item(l, item);
       } else {
         // Remove range of items, return list with values.
         end = tv_get_number_chk(&argvars[2], &error);

diff --git a/src/nvim/eval/typval.c b/src/nvim/eval/typval.c
@@ -389,6 +389,21 @@ void tv_list_remove_items(list_T *const l, listitem_T *const item,
   tv_list_drop_items(l, item, item2);
 }
 
+/// Remove single item without freeing it
+///
+/// @param  l  List to remove item from.
+/// @param  item  Item to remove.
+///
+/// @return Contents of the removed item.
+typval_T tv_list_pop_item(list_T *const l, listitem_T *const item)
+  FUNC_ATTR_NONNULL_ALL
+{
+  list_log(l, item, NULL, "pop");
+  const typval_T ret_tv = *TV_LIST_ITEM_TV(item);
+  tv_list_drop_items(l, item, item);
+  return ret_tv;
+}
+
 /// Move items "item" to "item2" from list "l" to the end of the list "tgt_l"
 ///
 /// @param[out]  l  List to move from.