From 253468749d1c35f48dce5c4db30e07f218506551 Mon Sep 17 00:00:00 2001
From: Karsten Hopp <karsten@fedoraproject.org>
Date: Aug 13 2007 11:48:57 +0000
Subject: patchlevel 54


---

diff --git a/7.1.054 b/7.1.054
new file mode 100644
index 0000000..42d60bb
--- /dev/null
+++ b/7.1.054
@@ -0,0 +1,148 @@
+To: vim-dev@vim.org
+Subject: patch 7.1.054
+Fcc: outbox
+From: Bram Moolenaar <Bram@moolenaar.net>
+Mime-Version: 1.0
+Content-Type: text/plain; charset=ISO-8859-1
+Content-Transfer-Encoding: 8bit
+------------
+
+Patch 7.1.054
+Problem:    Accessing uninitialized memory when displaying the fold column.
+Solution:   Add a NUL to the extra array. (Dominique Pelle).  Also do this in
+	    a couple of other situations.
+Files:	    src/screen.c
+
+
+*** ../vim-7.1.053/src/screen.c	Mon Jul 30 21:59:50 2007
+--- src/screen.c	Sun Aug  5 16:10:53 2007
+***************
+*** 2555,2561 ****
+  
+      char_u	extra[18];		/* "%ld" and 'fdc' must fit in here */
+      int		n_extra = 0;		/* number of extra chars */
+!     char_u	*p_extra = NULL;	/* string of extra chars */
+      int		c_extra = NUL;		/* extra chars, all the same */
+      int		extra_attr = 0;		/* attributes when n_extra != 0 */
+      static char_u *at_end_str = (char_u *)""; /* used for p_extra when
+--- 2555,2561 ----
+  
+      char_u	extra[18];		/* "%ld" and 'fdc' must fit in here */
+      int		n_extra = 0;		/* number of extra chars */
+!     char_u	*p_extra = NULL;	/* string of extra chars, plus NUL */
+      int		c_extra = NUL;		/* extra chars, all the same */
+      int		extra_attr = 0;		/* attributes when n_extra != 0 */
+      static char_u *at_end_str = (char_u *)""; /* used for p_extra when
+***************
+*** 3189,3198 ****
+  		if (cmdwin_type != 0 && wp == curwin)
+  		{
+  		    /* Draw the cmdline character. */
+- 		    *extra = cmdwin_type;
+  		    n_extra = 1;
+! 		    p_extra = extra;
+! 		    c_extra = NUL;
+  		    char_attr = hl_attr(HLF_AT);
+  		}
+  	    }
+--- 3189,3196 ----
+  		if (cmdwin_type != 0 && wp == curwin)
+  		{
+  		    /* Draw the cmdline character. */
+  		    n_extra = 1;
+! 		    c_extra = cmdwin_type;
+  		    char_attr = hl_attr(HLF_AT);
+  		}
+  	    }
+***************
+*** 3208,3213 ****
+--- 3206,3212 ----
+  		    fill_foldcolumn(extra, wp, FALSE, lnum);
+  		    n_extra = wp->w_p_fdc;
+  		    p_extra = extra;
++ 		    p_extra[n_extra] = NUL;
+  		    c_extra = NUL;
+  		    char_attr = hl_attr(HLF_FC);
+  		}
+***************
+*** 3550,3558 ****
+  	 * Get the next character to put on the screen.
+  	 */
+  	/*
+! 	 * The 'extra' array contains the extra stuff that is inserted to
+! 	 * represent special characters (non-printable stuff).  When all
+! 	 * characters are the same, c_extra is used.
+  	 * For the '$' of the 'list' option, n_extra == 1, p_extra == "".
+  	 */
+  	if (n_extra > 0)
+--- 3549,3559 ----
+  	 * Get the next character to put on the screen.
+  	 */
+  	/*
+! 	 * The "p_extra" points to the extra stuff that is inserted to
+! 	 * represent special characters (non-printable stuff) and other
+! 	 * things.  When all characters are the same, c_extra is used.
+! 	 * "p_extra" must end in a NUL to avoid mb_ptr2len() reads past
+! 	 * "p_extra[n_extra]".
+  	 * For the '$' of the 'list' option, n_extra == 1, p_extra == "".
+  	 */
+  	if (n_extra > 0)
+***************
+*** 3808,3817 ****
+  		 * a '<' in the first column. */
+  		if (n_skip > 0 && mb_l > 1)
+  		{
+- 		    extra[0] = '<';
+- 		    p_extra = extra;
+  		    n_extra = 1;
+! 		    c_extra = NUL;
+  		    c = ' ';
+  		    if (area_attr == 0 && search_attr == 0)
+  		    {
+--- 3809,3816 ----
+  		 * a '<' in the first column. */
+  		if (n_skip > 0 && mb_l > 1)
+  		{
+  		    n_extra = 1;
+! 		    c_extra = '<';
+  		    c = ' ';
+  		    if (area_attr == 0 && search_attr == 0)
+  		    {
+***************
+*** 6204,6211 ****
+  	return;
+  
+      off = LineOffset[row] + col;
+!     while (*ptr != NUL && col < screen_Columns
+! 				      && (len < 0 || (int)(ptr - text) < len))
+      {
+  	c = *ptr;
+  #ifdef FEAT_MBYTE
+--- 6203,6211 ----
+  	return;
+  
+      off = LineOffset[row] + col;
+!     while (col < screen_Columns
+! 	    && (len < 0 || (int)(ptr - text) < len)
+! 	    && *ptr != NUL)
+      {
+  	c = *ptr;
+  #ifdef FEAT_MBYTE
+*** ../vim-7.1.053/src/version.c	Sun Aug  5 19:20:04 2007
+--- src/version.c	Sun Aug  5 20:07:47 2007
+***************
+*** 668,669 ****
+--- 668,671 ----
+  {   /* Add new patch number below this line */
++ /**/
++     54,
+  /**/
+
+-- 
+From "know your smileys":
+ +<(:-) The Pope
+
+ /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
+///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
+\\\        download, build and distribute -- http://www.A-A-P.org        ///
+ \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///