From 7ed37dc53409331cd9e7e0e10238651f7bca2672 Mon Sep 17 00:00:00 2001
From: Huihui Huang <625173@qq.com>
Date: Sun, 8 Mar 2026 19:37:22 +0000
Subject: [PATCH] patch memory leak in list_extend_func() in list.c

Problem:  memory leak in list_extend_func() in list.c
Solution: Free l1 on early return (Huihui Huang)

closes: #19572

Signed-off-by: Huihui Huang <625173@qq.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---
 src/list.c    | 12 ++++++++----
 src/version.c |  2 ++
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/src/list.c b/src/list.c
index 310d8516b8..cd12bcb0a0 100644
--- a/src/list.c
+++ b/src/list.c
@@ -3025,8 +3025,7 @@ list_extend_func(
 	{
 	    before = (long)tv_get_number_chk(&argvars[2], &error);
 	    if (error)
-		return;		// type error; errmsg already given
-
+		goto cleanup;		// type error; errmsg already given
 	    if (before == l1->lv_len)
 		item = NULL;
 	    else
@@ -3035,7 +3034,7 @@ list_extend_func(
 		if (item == NULL)
 		{
 		    semsg(_(e_list_index_out_of_range_nr), before);
-		    return;
+		    goto cleanup;
 		}
 	    }
 	}
@@ -3043,7 +3042,7 @@ list_extend_func(
 	    item = NULL;
 	if (type != NULL && check_typval_arg_type(
 		    type, &argvars[1], func_name, 2) == FAIL)
-	    return;
+	    goto cleanup;
 	list_extend(l1, l2, item);
 
 	if (is_new)
@@ -3054,6 +3053,11 @@ list_extend_func(
 	}
 	else
 	    copy_tv(&argvars[0], rettv);
+	return;
+
+cleanup:
+	if (is_new)
+	    list_unref(l1);
     }
 }
 
diff --git a/src/version.c b/src/version.c
index 5fd399c977..4ad7d6aee5 100644
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    121,
 /**/
     120,
 /**/