commit 9cac424d05c0e79cd621f1b9f2f01a9f459fcbe6
author Bram Moolenaar <Bram@vim.org> Sun Jul 19 14:42:23 2015 +0200
committer Bram Moolenaar <Bram@vim.org> Sun Jul 19 14:42:23 2015 +0200
tree 33e43db58c2a729d6eec68b9da7c4f6c3b93e569
parent 5cbb8dbc329ab33ce56ea7ce4695778630c4e9ee

patch 7.4.789
Problem:    Using freed memory and crash. (Dominique Pellej)
Solution:   Correct use of pointers. (Hirohito Higashi)

src/option.c

diff --git a/src/option.c b/src/option.c
index 35cfd2b..a356f96 100644
--- a/src/option.c
+++ b/src/option.c
@@ -4943,7 +4943,8 @@
 
 			    sprintf((char *)buf_type, "%s",
 				(opt_flags & OPT_LOCAL) ? "local" : "global");
-			    set_vim_var_string(VV_OPTION_NEW, newval, -1);
+			    set_vim_var_string(VV_OPTION_NEW,
+							*(char_u **)varp, -1);
 			    set_vim_var_string(VV_OPTION_OLD, saved_origval, -1);
 			    set_vim_var_string(VV_OPTION_TYPE, buf_type, -1);
 			    apply_autocmds(EVENT_OPTIONSET,
@@ -5738,8 +5739,8 @@
 	    char_u buf_type[7];
 	    sprintf((char *)buf_type, "%s",
 		(opt_flags & OPT_LOCAL) ? "local" : "global");
-	    set_vim_var_string(VV_OPTION_NEW, s, -1);
-	    set_vim_var_string(VV_OPTION_OLD, oldval, -1);
+	    set_vim_var_string(VV_OPTION_NEW, *varp, -1);
+	    set_vim_var_string(VV_OPTION_OLD, saved_oldval, -1);
 	    set_vim_var_string(VV_OPTION_TYPE, buf_type, -1);
 	    apply_autocmds(EVENT_OPTIONSET, (char_u *)options[opt_idx].fullname, NULL, FALSE, NULL);
 	    reset_v_option_vars();

src/version.c

diff --git a/src/version.c b/src/version.c
index aa7b033..d2c8bc5 100644
--- a/src/version.c
+++ b/src/version.c
@@ -742,6 +742,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    789,
+/**/
     788,
 /**/
     787,