To: vim-dev@vim.org

Subject: Patch 7.2.273

Fcc: outbox

From: Bram Moolenaar <Bram@moolenaar.net>

Mime-Version: 1.0

Content-Type: text/plain; charset=UTF-8

Content-Transfer-Encoding: 8bit

------------

Patch 7.2.273

Problem:    Crash with redir to unknown array. (Christian Brabandt)

Solution:   Don't assign the redir result when there was an error.

Files:	    src/eval.c

*** ../vim-7.2.272/src/eval.c	2009-09-30 15:15:33.000000000 +0200

--- src/eval.c	2009-11-03 12:05:07.000000000 +0100

***************

*** 988,1000 ****

      int		err;

      typval_T	tv;

!     /* Make sure a valid variable name is specified */

      if (!eval_isnamec1(*name))

      {

  	EMSG(_(e_invarg));

  	return FAIL;

      }

      redir_varname = vim_strsave(name);

      if (redir_varname == NULL)

  	return FAIL;

--- 988,1001 ----

      int		err;

      typval_T	tv;

!     /* Catch a bad name early. */

      if (!eval_isnamec1(*name))

      {

  	EMSG(_(e_invarg));

  	return FAIL;

      }

+     /* Make a copy of the name, it is used in redir_lval until redir ends. */

      redir_varname = vim_strsave(name);

      if (redir_varname == NULL)

  	return FAIL;

***************

*** 1019,1024 ****

--- 1020,1026 ----

  	    EMSG(_(e_trailing));

  	else

  	    EMSG(_(e_invarg));

+ 	redir_endp = NULL;  /* don't store a value, only cleanup */

  	var_redir_stop();

  	return FAIL;

      }

***************

*** 1037,1042 ****

--- 1039,1045 ----

      did_emsg |= save_emsg;

      if (err)

      {

+ 	redir_endp = NULL;  /* don't store a value, only cleanup */

  	var_redir_stop();

  	return FAIL;

      }

***************

*** 1085,1090 ****

--- 1088,1094 ----

  /*

   * Stop redirecting command output to a variable.

+  * Frees the allocated memory.

   */

      void

  var_redir_stop()

***************

*** 1093,1106 ****

      if (redir_lval != NULL)

      {

! 	/* Append the trailing NUL. */

! 	ga_append(&redir_ga, NUL);

! 	/* Assign the text to the variable. */

! 	tv.v_type = VAR_STRING;

! 	tv.vval.v_string = redir_ga.ga_data;

! 	set_var_lval(redir_lval, redir_endp, &tv, FALSE, (char_u *)".");

! 	vim_free(tv.vval.v_string);

  	clear_lval(redir_lval);

  	vim_free(redir_lval);

--- 1097,1114 ----

      if (redir_lval != NULL)

      {

! 	/* If there was no error: assign the text to the variable. */

! 	if (redir_endp != NULL)

! 	{

! 	    ga_append(&redir_ga, NUL);  /* Append the trailing NUL. */

! 	    tv.v_type = VAR_STRING;

! 	    tv.vval.v_string = redir_ga.ga_data;

! 	    set_var_lval(redir_lval, redir_endp, &tv, FALSE, (char_u *)".");

! 	}

! 	/* free the collected output */

! 	vim_free(redir_ga.ga_data);

! 	redir_ga.ga_data = NULL;

  	clear_lval(redir_lval);

  	vim_free(redir_lval);

*** ../vim-7.2.272/src/version.c	2009-11-03 13:06:03.000000000 +0100

--- src/version.c	2009-11-03 14:24:06.000000000 +0100

***************

*** 678,679 ****

--- 678,681 ----

  {   /* Add new patch number below this line */

+ /**/

+     273,

  /**/

-- 

Permission is granted to read this message out aloud on Kings Cross Road,

London, under the condition that the orator is properly dressed.

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\

///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\

\\\        download, build and distribute -- http://www.A-A-P.org        ///

 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///