To: vim-dev@vim.org
Subject: patch 7.0.183
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
------------

Patch 7.0.183
Problem:    Crash in ":let" when redirecting to a variable that's being
	    displayed. (Thomas Link)
Solution:   When redirecting to a variable only do the assignment when
	    stopping redirection to avoid that setting the variable causes a
	    freed string to be accessed.
Files:	    src/eval.c


*** ../vim-7.0.182/src/eval.c	Tue Dec  5 10:33:57 2006
--- src/eval.c	Sun Jan 14 14:20:49 2007
***************
*** 898,903 ****
--- 898,904 ----
  }
  
  static lval_T	*redir_lval = NULL;
+ static garray_T redir_ga;	/* only valid when redir_lval is not NULL */
  static char_u	*redir_endp = NULL;
  static char_u	*redir_varname = NULL;
  
***************
*** 932,937 ****
--- 933,941 ----
  	return FAIL;
      }
  
+     /* The output is stored in growarray "redir_ga" until redirection ends. */
+     ga_init2(&redir_ga, (int)sizeof(char), 500);
+ 
      /* Parse the variable name (can be a dict or list entry). */
      redir_endp = get_lval(redir_varname, NULL, redir_lval, FALSE, FALSE, FALSE,
  							     FNE_CHECK_START);
***************
*** 974,1015 ****
  }
  
  /*
!  * Append "value[len]" to the variable set by var_redir_start().
   */
      void
! var_redir_str(value, len)
      char_u	*value;
!     int		len;
  {
!     char_u	*val;
!     typval_T	tv;
!     int		save_emsg;
!     int		err;
  
      if (redir_lval == NULL)
  	return;
  
!     if (len == -1)
! 	/* Append the entire string */
! 	val = vim_strsave(value);
!     else
! 	/* Append only the specified number of characters */
! 	val = vim_strnsave(value, len);
!     if (val == NULL)
! 	return;
! 
!     tv.v_type = VAR_STRING;
!     tv.vval.v_string = val;
  
!     save_emsg = did_emsg;
!     did_emsg = FALSE;
!     set_var_lval(redir_lval, redir_endp, &tv, FALSE, (char_u *)".");
!     err = did_emsg;
!     did_emsg |= save_emsg;
!     if (err)
  	var_redir_stop();
- 
-     vim_free(tv.vval.v_string);
  }
  
  /*
--- 978,1013 ----
  }
  
  /*
!  * Append "value[value_len]" to the variable set by var_redir_start().
!  * The actual appending is postponed until redirection ends, because the value
!  * appended may in fact be the string we write to, changing it may cause freed
!  * memory to be used:
!  *   :redir => foo
!  *   :let foo
!  *   :redir END
   */
      void
! var_redir_str(value, value_len)
      char_u	*value;
!     int		value_len;
  {
!     size_t	len;
  
      if (redir_lval == NULL)
  	return;
  
!     if (value_len == -1)
! 	len = STRLEN(value);	/* Append the entire string */
!     else
! 	len = value_len;	/* Append only "value_len" characters */
  
!     if (ga_grow(&redir_ga, (int)len) == OK)
!     {
! 	mch_memmove((char *)redir_ga.ga_data + redir_ga.ga_len, value, len);
! 	redir_ga.ga_len += len;
!     }
!     else
  	var_redir_stop();
  }
  
  /*
***************
*** 1018,1025 ****
--- 1016,1034 ----
      void
  var_redir_stop()
  {
+     typval_T	tv;
+ 
      if (redir_lval != NULL)
      {
+ 	/* Append the trailing NUL. */
+ 	ga_append(&redir_ga, NUL);
+ 
+ 	/* Assign the text to the variable. */
+ 	tv.v_type = VAR_STRING;
+ 	tv.vval.v_string = redir_ga.ga_data;
+ 	set_var_lval(redir_lval, redir_endp, &tv, FALSE, (char_u *)".");
+ 	vim_free(tv.vval.v_string);
+ 
  	clear_lval(redir_lval);
  	vim_free(redir_lval);
  	redir_lval = NULL;
*** ../vim-7.0.182/src/version.c	Tue Jan  9 20:29:55 2007
--- src/version.c	Sun Jan 14 15:23:23 2007
***************
*** 668,669 ****
--- 668,671 ----
  {   /* Add new patch number below this line */
+ /**/
+     183,
  /**/

-- 
How To Keep A Healthy Level Of Insanity:
16. Have your coworkers address you by your wrestling name, Rock Hard Kim.

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\        download, build and distribute -- http://www.A-A-P.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///