To: vim-dev@vim.org

Subject: Patch 7.2.149

Fcc: outbox

From: Bram Moolenaar <Bram@moolenaar.net>

Mime-Version: 1.0

Content-Type: text/plain; charset=ISO-8859-1

Content-Transfer-Encoding: 8bit

------------

Patch 7.2.149

Problem:    Using return value of function that doesn't return a value results

	    in reading uninitialized memory.

Solution:   Set the default to return zero.  Make cursor() return -1 on

	    failure.  Let complete() return an empty string in case of an

	    error.  (partly by Dominique Pelle)

Files:	    runtime/doc/eval.txt, src/eval.c

*** ../vim-7.2.148/runtime/doc/eval.txt	Tue Dec  9 10:56:50 2008

--- runtime/doc/eval.txt	Sun Mar 22 14:28:49 2009

***************

*** 2414,2419 ****

--- 2419,2425 ----

  		When 'virtualedit' is used {off} specifies the offset in

  		screen columns from the start of the character.  E.g., a

  		position within a <Tab> or after the last character.

+ 		Returns 0 when the position could be set, -1 otherwise.

  deepcopy({expr}[, {noref}])				*deepcopy()* *E698*

***************

*** 4516,4521 ****

--- 4526,4532 ----

  		should also work to move files across file systems.  The

  		result is a Number, which is 0 if the file was renamed

  		successfully, and non-zero when the renaming failed.

+ 		NOTE: If {to} exists it is overwritten without warning.

  		This function is not available in the |sandbox|.

  repeat({expr}, {count})					*repeat()*

*** ../vim-7.2.148/src/eval.c	Wed Feb  4 16:25:53 2009

--- src/eval.c	Sun Mar 22 20:45:18 2009

***************

*** 1285,1291 ****

--- 1285,1293 ----

      typval_T	tv;

      char_u	*retval;

      garray_T	ga;

+ #ifdef FEAT_FLOAT

      char_u	numbuf[NUMBUFLEN];

+ #endif

      if (eval0(arg, &tv, nextcmd, TRUE) == FAIL)

  	retval = NULL;

***************

*** 8018,8024 ****

      /* execute the function if no errors detected and executing */

      if (evaluate && error == ERROR_NONE)

      {

! 	rettv->v_type = VAR_NUMBER;	/* default is number rettv */

  	error = ERROR_UNKNOWN;

  	if (!builtin_function(fname))

--- 8020,8027 ----

      /* execute the function if no errors detected and executing */

      if (evaluate && error == ERROR_NONE)

      {

! 	rettv->v_type = VAR_NUMBER;	/* default rettv is number zero */

! 	rettv->vval.v_number = 0;

  	error = ERROR_UNKNOWN;

  	if (!builtin_function(fname))

***************

*** 8268,8274 ****

  		return;

  	    li = l->lv_first;

  	}

- 	rettv->vval.v_number = 0;	/* Default: Success */

  	for (;;)

  	{

  	    if (l == NULL)

--- 8271,8276 ----

***************

*** 8728,8734 ****

      int		dummy;

      dict_T	*selfdict = NULL;

-     rettv->vval.v_number = 0;

      if (argvars[1].v_type != VAR_LIST)

      {

  	EMSG(_(e_listreq));

--- 8730,8735 ----

***************

*** 9036,9048 ****

      if (buttons == NULL || *buttons == NUL)

  	buttons = (char_u *)_("&Ok");

!     if (error)

! 	rettv->vval.v_number = 0;

!     else

  	rettv->vval.v_number = do_dialog(type, NULL, message, buttons,

  								   def, NULL);

- #else

-     rettv->vval.v_number = 0;

  #endif

  }

--- 9037,9045 ----

      if (buttons == NULL || *buttons == NUL)

  	buttons = (char_u *)_("&Ok");

!     if (!error)

  	rettv->vval.v_number = do_dialog(type, NULL, message, buttons,

  								   def, NULL);

  #endif

  }

***************

*** 9181,9195 ****

      }

      rettv->vval.v_number = cs_connection(num, dbpath, prepend);

- #else

-     rettv->vval.v_number = 0;

  #endif

  }

  /*

   * "cursor(lnum, col)" function

   *

!  * Moves the cursor to the specified line and column

   */

  /*ARGSUSED*/

      static void

--- 9178,9191 ----

      }

      rettv->vval.v_number = cs_connection(num, dbpath, prepend);

  #endif

  }

  /*

   * "cursor(lnum, col)" function

   *

!  * Moves the cursor to the specified line and column.

!  * Returns 0 when the position could be set, -1 otherwise.

   */

  /*ARGSUSED*/

      static void

***************

*** 9202,9207 ****

--- 9198,9204 ----

      long	coladd = 0;

  #endif

+     rettv->vval.v_number = -1;

      if (argvars[1].v_type == VAR_UNKNOWN)

      {

  	pos_T	    pos;

***************

*** 9246,9251 ****

--- 9243,9249 ----

  #endif

      curwin->w_set_curswant = TRUE;

+     rettv->vval.v_number = 0;

  }

  /*

***************

*** 9291,9298 ****

  {

  #ifdef FEAT_AUTOCMD

      rettv->vval.v_number = did_filetype;

- #else

-     rettv->vval.v_number = 0;

  #endif

  }

--- 9289,9294 ----

***************

*** 9605,9611 ****

      typval_T	*argvars;

      typval_T	*rettv;

  {

-     rettv->vval.v_number = 0;

      if (argvars[0].v_type == VAR_LIST && argvars[1].v_type == VAR_LIST)

      {

  	list_T		*l1, *l2;

--- 9601,9606 ----

***************

*** 9733,9739 ****

      if (check_secure())

  	return;

-     rettv->vval.v_number = 0;

      keys = get_tv_string(&argvars[0]);

      if (*keys != NUL)

      {

--- 9728,9733 ----

***************

*** 9901,9907 ****

      char_u	*ermsg = map ? (char_u *)"map()" : (char_u *)"filter()";

      int		save_did_emsg;

-     rettv->vval.v_number = 0;

      if (argvars[0].v_type == VAR_LIST)

      {

  	if ((l = argvars[0].vval.v_list) == NULL

--- 9895,9900 ----

***************

*** 10084,10091 ****

  	else

  	    rettv->vval.v_number = (varnumber_T)f;

      }

-     else

- 	rettv->vval.v_number = 0;

  }

  /*

--- 10077,10082 ----

***************

*** 10219,10227 ****

      lnum = get_tv_lnum(argvars);

      if (lnum >= 1 && lnum <= curbuf->b_ml.ml_line_count)

  	rettv->vval.v_number = foldLevel(lnum);

-     else

  #endif

- 	rettv->vval.v_number = 0;

  }

  /*

--- 10210,10216 ----

***************

*** 10337,10343 ****

      typval_T	*argvars;

      typval_T	*rettv;

  {

-     rettv->vval.v_number = 0;

  #ifdef FEAT_GUI

      if (gui.in_use)

  	gui_mch_set_foreground();

--- 10326,10331 ----

***************

*** 10359,10365 ****

  {

      char_u	*s;

-     rettv->vval.v_number = 0;

      s = get_tv_string(&argvars[0]);

      if (s == NULL || *s == NUL || VIM_ISDIGIT(*s))

  	EMSG2(_(e_invarg2), s);

--- 10347,10352 ----

***************

*** 10429,10437 ****

      if (tv == NULL)

      {

! 	if (argvars[2].v_type == VAR_UNKNOWN)

! 	    rettv->vval.v_number = 0;

! 	else

  	    copy_tv(&argvars[2], rettv);

      }

      else

--- 10416,10422 ----

      if (tv == NULL)

      {

! 	if (argvars[2].v_type != VAR_UNKNOWN)

  	    copy_tv(&argvars[2], rettv);

      }

      else

***************

*** 10456,10468 ****

  {

      char_u	*p;

!     if (retlist)

!     {

! 	if (rettv_list_alloc(rettv) == FAIL)

! 	    return;

!     }

!     else

! 	rettv->vval.v_number = 0;

      if (buf == NULL || buf->b_ml.ml_mfp == NULL || start < 0)

  	return;

--- 10441,10448 ----

  {

      char_u	*p;

!     if (retlist && rettv_list_alloc(rettv) == FAIL)

! 	return;

      if (buf == NULL || buf->b_ml.ml_mfp == NULL || start < 0)

  	return;

***************

*** 11009,11016 ****

      dict_T	*dict;

      matchitem_T	*cur = curwin->w_match_head;

-     rettv->vval.v_number = 0;

- 

      if (rettv_list_alloc(rettv) == OK)

      {

  	while (cur != NULL)

--- 10989,10994 ----

***************

*** 11089,11095 ****

      win_T	*wp;

  #endif

-     rettv->vval.v_number = 0;

  #ifdef FEAT_QUICKFIX

      if (rettv_list_alloc(rettv) == OK)

      {

--- 11067,11072 ----

***************

*** 11935,11941 ****

      typval_T	*argvars;

      typval_T	*rettv;

  {

-     rettv->vval.v_number = 0;

      if (argvars[0].v_type != VAR_DICT)

      {

  	EMSG(_(e_dictreq));

--- 11912,11917 ----

***************

*** 12052,12059 ****

  	n = del_history_entry(get_histtype(str),

  				      get_tv_string_buf(&argvars[1], buf));

      rettv->vval.v_number = n;

- #else

-     rettv->vval.v_number = 0;

  #endif

  }

--- 12028,12033 ----

***************

*** 12415,12421 ****

      int		selected;

      int		mouse_used;

-     rettv->vval.v_number = 0;

  #ifdef NO_CONSOLE_INPUT

      /* While starting up, there is no place to enter text. */

      if (no_console_input())

--- 12389,12394 ----

***************

*** 12464,12470 ****

  	--ga_userinput.ga_len;

  	restore_typeahead((tasave_T *)(ga_userinput.ga_data)

  						       + ga_userinput.ga_len);

! 	rettv->vval.v_number = 0; /* OK */

      }

      else if (p_verbose > 1)

      {

--- 12437,12443 ----

  	--ga_userinput.ga_len;

  	restore_typeahead((tasave_T *)(ga_userinput.ga_data)

  						       + ga_userinput.ga_len);

! 	/* default return is zero == OK */

      }

      else if (p_verbose > 1)

      {

***************

*** 12488,12494 ****

  	save_typeahead((tasave_T *)(ga_userinput.ga_data)

  						       + ga_userinput.ga_len);

  	++ga_userinput.ga_len;

! 	rettv->vval.v_number = 0; /* OK */

      }

      else

  	rettv->vval.v_number = 1; /* Failed */

--- 12461,12467 ----

  	save_typeahead((tasave_T *)(ga_userinput.ga_data)

  						       + ga_userinput.ga_len);

  	++ga_userinput.ga_len;

! 	/* default return is zero == OK */

      }

      else

  	rettv->vval.v_number = 1; /* Failed */

***************

*** 12522,12528 ****

      list_T	*l;

      int		error = FALSE;

-     rettv->vval.v_number = 0;

      if (argvars[0].v_type != VAR_LIST)

  	EMSG2(_(e_listarg), "insert()");

      else if ((l = argvars[0].vval.v_list) != NULL

--- 12495,12500 ----

***************

*** 12641,12647 ****

      dict_T	*d;

      int		todo;

-     rettv->vval.v_number = 0;

      if (argvars[0].v_type != VAR_DICT)

      {

  	EMSG(_(e_dictreq));

--- 12613,12618 ----

***************

*** 12729,12735 ****

      garray_T	ga;

      char_u	*sep;

-     rettv->vval.v_number = 0;

      if (argvars[0].v_type != VAR_LIST)

      {

  	EMSG(_(e_listreq));

--- 12700,12705 ----

***************

*** 12827,12835 ****

  #endif

      rettv->v_type = type;

!     if (type == VAR_NUMBER)

! 	rettv->vval.v_number = 0;

!     else

  	rettv->vval.v_string = NULL;

      if (check_restricted() || check_secure())

--- 12797,12803 ----

  #endif

      rettv->v_type = type;

!     if (type != VAR_NUMBER)

  	rettv->vval.v_string = NULL;

      if (check_restricted() || check_secure())

***************

*** 13770,13776 ****

      typval_T	*argvars;

      typval_T	*rettv;

  {

-     rettv->vval.v_number = 0;

  #ifdef FEAT_INS_EXPAND

      if (pum_visible())

  	rettv->vval.v_number = 1;

--- 13738,13743 ----

***************

*** 13804,13810 ****

  	    stride = get_tv_number_chk(&argvars[2], &error);

      }

-     rettv->vval.v_number = 0;

      if (error)

  	return;		/* type error; errmsg already given */

      if (stride == 0)

--- 13771,13776 ----

***************

*** 14193,14199 ****

      typval_T	*argvars;

      typval_T	*rettv;

  {

-     rettv->vval.v_number = 0;

  #ifdef FEAT_CLIENTSERVER

  # ifdef WIN32

      /* On Win32 it's done in this application. */

--- 14159,14164 ----

***************

*** 14249,14255 ****

  	rettv->vval.v_number = (s != NULL);

      }

  # else

-     rettv->vval.v_number = 0;

      if (check_connection() == FAIL)

  	return;

--- 14214,14219 ----

***************

*** 14338,14344 ****

      dict_T	*d;

      dictitem_T	*di;

-     rettv->vval.v_number = 0;

      if (argvars[0].v_type == VAR_DICT)

      {

  	if (argvars[2].v_type != VAR_UNKNOWN)

--- 14302,14307 ----

***************

*** 14696,14702 ****

      list_T	*l;

      listitem_T	*li, *ni;

-     rettv->vval.v_number = 0;

      if (argvars[0].v_type != VAR_LIST)

  	EMSG2(_(e_listarg), "reverse()");

      else if ((l = argvars[0].vval.v_list) != NULL

--- 14659,14664 ----

***************

*** 15048,15055 ****

      int		lnum = 0;

      int		col = 0;

-     rettv->vval.v_number = 0;

- 

      if (rettv_list_alloc(rettv) == FAIL)

  	return;

--- 15010,15015 ----

***************

*** 15236,15243 ****

      int		n;

      int		flags = 0;

-     rettv->vval.v_number = 0;

- 

      if (rettv_list_alloc(rettv) == FAIL)

  	return;

--- 15196,15201 ----

***************

*** 15323,15330 ****

      typval_T	*varp;

      char_u	nbuf[NUMBUFLEN];

-     rettv->vval.v_number = 0;

- 

      if (check_restricted() || check_secure())

  	return;

      (void)get_tv_number(&argvars[0]);	    /* issue errmsg if type error */

--- 15281,15286 ----

***************

*** 15404,15410 ****

      else

  	line = get_tv_string_chk(&argvars[1]);

!     rettv->vval.v_number = 0;		/* OK */

      for (;;)

      {

  	if (l != NULL)

--- 15360,15366 ----

      else

  	line = get_tv_string_chk(&argvars[1]);

!     /* default result is zero == OK */

      for (;;)

      {

  	if (l != NULL)

***************

*** 15717,15722 ****

--- 15673,15679 ----

  /*

   * "setwinvar()" and "settabwinvar()" functions

   */

+ /*ARGSUSED*/

      static void

  setwinvar(argvars, rettv, off)

      typval_T	*argvars;

***************

*** 15733,15740 ****

      char_u	nbuf[NUMBUFLEN];

      tabpage_T	*tp;

-     rettv->vval.v_number = 0;

- 

      if (check_restricted() || check_secure())

  	return;

--- 15690,15695 ----

***************

*** 15947,15953 ****

      long	len;

      long	i;

-     rettv->vval.v_number = 0;

      if (argvars[0].v_type != VAR_LIST)

  	EMSG2(_(e_listarg), "sort()");

      else

--- 15902,15907 ----

***************

*** 16870,16878 ****

      typval_T	*argvars;

      typval_T	*rettv;

  {

! #ifndef FEAT_WINDOWS

!     rettv->vval.v_number = 0;

! #else

      tabpage_T	*tp;

      win_T	*wp = NULL;

--- 16824,16830 ----

      typval_T	*argvars;

      typval_T	*rettv;

  {

! #ifdef FEAT_WINDOWS

      tabpage_T	*tp;

      win_T	*wp = NULL;

***************

*** 16884,16902 ****

  	if (tp != NULL)

  	    wp = (tp == curtab) ? firstwin : tp->tp_firstwin;

      }

!     if (wp == NULL)

! 	rettv->vval.v_number = 0;

!     else

      {

! 	if (rettv_list_alloc(rettv) == FAIL)

! 	    rettv->vval.v_number = 0;

! 	else

! 	{

! 	    for (; wp != NULL; wp = wp->w_next)

! 		if (list_append_number(rettv->vval.v_list,

  						wp->w_buffer->b_fnum) == FAIL)

! 		    break;

! 	}

      }

  #endif

  }

--- 16836,16847 ----

  	if (tp != NULL)

  	    wp = (tp == curtab) ? firstwin : tp->tp_firstwin;

      }

!     if (wp != NULL && rettv_list_alloc(rettv) != FAIL)

      {

! 	for (; wp != NULL; wp = wp->w_next)

! 	    if (list_append_number(rettv->vval.v_list,

  						wp->w_buffer->b_fnum) == FAIL)

! 		break;

      }

  #endif

  }

***************

*** 17024,17033 ****

      int		first;

      if (rettv_list_alloc(rettv) == FAIL)

-     {

- 	rettv->vval.v_number = 0;

  	return;

-     }

      for (first = TRUE; ; first = FALSE)

  	if (get_tagfname(&tn, first, fname) == FAIL

--- 16969,16975 ----

***************

*** 17401,17408 ****

      /* A non-zero number or non-empty string argument: reset mode. */

      if (non_zero_arg(&argvars[0]))

  	curbuf->b_visual_mode_eval = NUL;

- #else

-     rettv->vval.v_number = 0; /* return anything, it won't work anyway */

  #endif

  }

--- 17343,17348 ----

*** ../vim-7.2.148/src/version.c	Wed Mar 18 19:07:09 2009

--- src/version.c	Wed Apr 22 12:44:05 2009

***************

*** 678,679 ****

--- 678,681 ----

  {   /* Add new patch number below this line */

+ /**/

+     149,

  /**/

-- 

WOMAN:   Well, 'ow did you become king then?

ARTHUR:  The Lady of the Lake, [angels sing] her arm clad in the purest

         shimmering samite, held aloft Excalibur from the bosom of the water

         signifying by Divine Providence that I, Arthur, was to carry

         Excalibur.  [singing stops] That is why I am your king!

                                  The Quest for the Holy Grail (Monty Python)

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\

///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\

\\\        download, build and distribute -- http://www.A-A-P.org        ///

 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///