commit 50ab994ab34fcbe0046a9a998ee420be196334ba
author Bram Moolenaar <Bram@vim.org> Mon Apr 13 15:28:12 2015 +0200
committer Bram Moolenaar <Bram@vim.org> Mon Apr 13 15:28:12 2015 +0200
tree c75c1642431da3702b039b156afc6a7e24e2b998
parent 7c94ce910f07e0d76d66b46bccfe39a07d8e1f6d

patch 7.4.696
Problem:    Not freeing memory when encountering an error.
Solution:   Free the stack before returning. (Eliseo Martínez)

src/regexp_nfa.c

diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
index e67f638..825f960 100644
--- a/src/regexp_nfa.c
+++ b/src/regexp_nfa.c
@@ -3156,6 +3156,7 @@
 		    if (stackp < stack)			\
 		    {					\
 			st_error(postfix, end, p);	\
+			vim_free(stack);		\
 			return NULL;			\
 		    }
 
@@ -3632,10 +3633,16 @@
 
     e = POP();
     if (stackp != stack)
+    {
+	vim_free(stack);
 	EMSG_RET_NULL(_("E875: (NFA regexp) (While converting from postfix to NFA), too many states left on stack"));
+    }
 
     if (istate >= nstate)
+    {
+	vim_free(stack);
 	EMSG_RET_NULL(_("E876: (NFA regexp) Not enough space to store the whole NFA "));
+    }
 
     matchstate = &state_ptr[istate++]; /* the match state */
     matchstate->c = NFA_MATCH;

src/version.c

diff --git a/src/version.c b/src/version.c
index 4cbf4b6..21261e4 100644
--- a/src/version.c
+++ b/src/version.c
@@ -742,6 +742,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    696,
+/**/
     695,
 /**/
     694,