To: vim-dev@vim.org
Subject: patch 7.1.074
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
------------

Patch 7.1.074
Problem:    Crash when calling string() on a recurively nested List.
Solution:   Check result value for being NULL. (Yukihiro Nakadaira)
Files:	    src/eval.c


*** ../vim-7.1.073/src/eval.c	Mon Aug  6 22:27:12 2007
--- src/eval.c	Tue Aug 14 22:01:12 2007
***************
*** 6802,6808 ****
   * "numbuf" is used for a number.
   * Does not put quotes around strings, as ":echo" displays values.
   * When "copyID" is not NULL replace recursive lists and dicts with "...".
!  * May return NULL;
   */
      static char_u *
  echo_string(tv, tofree, numbuf, copyID)
--- 6802,6808 ----
   * "numbuf" is used for a number.
   * Does not put quotes around strings, as ":echo" displays values.
   * When "copyID" is not NULL replace recursive lists and dicts with "...".
!  * May return NULL.
   */
      static char_u *
  echo_string(tv, tofree, numbuf, copyID)
***************
*** 6887,6893 ****
   * If the memory is allocated "tofree" is set to it, otherwise NULL.
   * "numbuf" is used for a number.
   * Puts quotes around strings, so that they can be parsed back by eval().
!  * May return NULL;
   */
      static char_u *
  tv2string(tv, tofree, numbuf, copyID)
--- 6887,6893 ----
   * If the memory is allocated "tofree" is set to it, otherwise NULL.
   * "numbuf" is used for a number.
   * Puts quotes around strings, so that they can be parsed back by eval().
!  * May return NULL.
   */
      static char_u *
  tv2string(tv, tofree, numbuf, copyID)
***************
*** 14974,14979 ****
--- 14974,14983 ----
  
      p1 = tv2string(&(*(listitem_T **)s1)->li_tv, &tofree1, numbuf1, 0);
      p2 = tv2string(&(*(listitem_T **)s2)->li_tv, &tofree2, numbuf2, 0);
+     if (p1 == NULL)
+ 	p1 = (char_u *)"";
+     if (p2 == NULL)
+ 	p2 = (char_u *)"";
      if (item_compare_ic)
  	res = STRICMP(p1, p2);
      else
***************
*** 15463,15469 ****
  
      rettv->v_type = VAR_STRING;
      rettv->vval.v_string = tv2string(&argvars[0], &tofree, numbuf, 0);
!     if (tofree == NULL)
  	rettv->vval.v_string = vim_strsave(rettv->vval.v_string);
  }
  
--- 15467,15474 ----
  
      rettv->v_type = VAR_STRING;
      rettv->vval.v_string = tv2string(&argvars[0], &tofree, numbuf, 0);
!     /* Make a copy if we have a value but it's not in allocate memory. */
!     if (rettv->vval.v_string != NULL && tofree == NULL)
  	rettv->vval.v_string = vim_strsave(rettv->vval.v_string);
  }
  
***************
*** 20167,20172 ****
--- 20174,20180 ----
  		char_u	buf[MSG_BUF_LEN];
  		char_u	numbuf2[NUMBUFLEN];
  		char_u	*tofree;
+ 		char_u	*s;
  
  		msg_puts((char_u *)"(");
  		for (i = 0; i < argcount; ++i)
***************
*** 20177,20186 ****
  			msg_outnum((long)argvars[i].vval.v_number);
  		    else
  		    {
! 			trunc_string(tv2string(&argvars[i], &tofree,
! 					      numbuf2, 0), buf, MSG_BUF_CLEN);
! 			msg_puts(buf);
! 			vim_free(tofree);
  		    }
  		}
  		msg_puts((char_u *)")");
--- 20185,20197 ----
  			msg_outnum((long)argvars[i].vval.v_number);
  		    else
  		    {
! 			s = tv2string(&argvars[i], &tofree, numbuf2, 0);
! 			if (s != NULL)
! 			{
! 			    trunc_string(s, buf, MSG_BUF_CLEN);
! 			    msg_puts(buf);
! 			    vim_free(tofree);
! 			}
  		    }
  		}
  		msg_puts((char_u *)")");
***************
*** 20258,20271 ****
  	    char_u	buf[MSG_BUF_LEN];
  	    char_u	numbuf2[NUMBUFLEN];
  	    char_u	*tofree;
  
  	    /* The value may be very long.  Skip the middle part, so that we
  	     * have some idea how it starts and ends. smsg() would always
  	     * truncate it at the end. */
! 	    trunc_string(tv2string(fc.rettv, &tofree, numbuf2, 0),
! 							   buf, MSG_BUF_CLEN);
! 	    smsg((char_u *)_("%s returning %s"), sourcing_name, buf);
! 	    vim_free(tofree);
  	}
  	msg_puts((char_u *)"\n");   /* don't overwrite this either */
  
--- 20269,20286 ----
  	    char_u	buf[MSG_BUF_LEN];
  	    char_u	numbuf2[NUMBUFLEN];
  	    char_u	*tofree;
+ 	    char_u	*s;
  
  	    /* The value may be very long.  Skip the middle part, so that we
  	     * have some idea how it starts and ends. smsg() would always
  	     * truncate it at the end. */
! 	    s = tv2string(fc.rettv, &tofree, numbuf2, 0);
! 	    if (s != NULL)
! 	    {
! 		trunc_string(s, buf, MSG_BUF_CLEN);
! 		smsg((char_u *)_("%s returning %s"), sourcing_name, buf);
! 		vim_free(tofree);
! 	    }
  	}
  	msg_puts((char_u *)"\n");   /* don't overwrite this either */
  
*** ../vim-7.1.073/src/version.c	Tue Aug 14 22:15:53 2007
--- src/version.c	Tue Aug 14 22:27:24 2007
***************
*** 668,669 ****
--- 668,671 ----
  {   /* Add new patch number below this line */
+ /**/
+     74,
  /**/

-- 
hundred-and-one symptoms of being an internet addict:
159. You get excited whenever discussing your hard drive.

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\        download, build and distribute -- http://www.A-A-P.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///