From 84a0c0b51cfc31f17a8b9e083682a4270f061b44 Mon Sep 17 00:00:00 2001
From: Karsten Hopp <karsten@fedoraproject.org>
Date: Jul 11 2007 09:20:15 +0000
Subject: Patchlevel 20


---

diff --git a/7.1.020 b/7.1.020
new file mode 100644
index 0000000..c343cb0
--- /dev/null
+++ b/7.1.020
@@ -0,0 +1,115 @@
+To: vim-dev@vim.org
+Subject: patch 7.1.020
+Fcc: outbox
+From: Bram Moolenaar <Bram@moolenaar.net>
+Mime-Version: 1.0
+Content-Type: text/plain; charset=ISO-8859-1
+Content-Transfer-Encoding: 8bit
+------------
+
+Patch 7.1.020
+Problem:    Reading from uninitialized memory when using a dialog. (Dominique
+	    Pelle)
+Solution:   In msg_show_console_dialog() append a NUL after every appended
+	    character.
+Files:	    src/message.c
+
+
+*** ../vim-7.1.019/src/message.c	Thu May 10 18:49:39 2007
+--- src/message.c	Sun Jul  1 12:06:52 2007
+***************
+*** 3456,3466 ****
+  		    /* advance to next hotkey and set default hotkey */
+  #ifdef FEAT_MBYTE
+  		    if (has_mbyte)
+! 			hotkp += (*mb_ptr2len)(hotkp);
+  		    else
+  #endif
+  			++hotkp;
+! 		    (void)copy_char(r + 1, hotkp, TRUE);
+  		    if (dfltbutton)
+  			--dfltbutton;
+  
+--- 3456,3466 ----
+  		    /* advance to next hotkey and set default hotkey */
+  #ifdef FEAT_MBYTE
+  		    if (has_mbyte)
+! 			hotkp += STRLEN(hotkp);
+  		    else
+  #endif
+  			++hotkp;
+! 		    hotkp[copy_char(r + 1, hotkp, TRUE)] = NUL;
+  		    if (dfltbutton)
+  			--dfltbutton;
+  
+***************
+*** 3493,3499 ****
+  			*msgp++ = (dfltbutton == 1) ? ']' : ')';
+  
+  			/* redefine hotkey */
+! 			(void)copy_char(r, hotkp, TRUE);
+  		    }
+  		}
+  		else
+--- 3493,3499 ----
+  			*msgp++ = (dfltbutton == 1) ? ']' : ')';
+  
+  			/* redefine hotkey */
+! 			hotkp[copy_char(r, hotkp, TRUE)] = NUL;
+  		    }
+  		}
+  		else
+***************
+*** 3519,3526 ****
+  	    *msgp++ = ':';
+  	    *msgp++ = ' ';
+  	    *msgp = NUL;
+- 	    mb_ptr_adv(hotkp);
+- 	    *hotkp = NUL;
+  	}
+  	else
+  	{
+--- 3519,3524 ----
+***************
+*** 3555,3562 ****
+  	    msgp = confirm_msg + 1 + STRLEN(message);
+  	    hotkp = hotk;
+  
+! 	    /* define first default hotkey */
+! 	    (void)copy_char(buttons, hotkp, TRUE);
+  
+  	    /* Remember where the choices start, displaying starts here when
+  	     * "hotkp" typed at the more prompt. */
+--- 3553,3561 ----
+  	    msgp = confirm_msg + 1 + STRLEN(message);
+  	    hotkp = hotk;
+  
+! 	    /* Define first default hotkey.  Keep the hotkey string NUL
+! 	     * terminated to avoid reading past the end. */
+! 	    hotkp[copy_char(buttons, hotkp, TRUE)] = NUL;
+  
+  	    /* Remember where the choices start, displaying starts here when
+  	     * "hotkp" typed at the more prompt. */
+*** ../vim-7.1.019/src/version.c	Thu Jul  5 09:53:20 2007
+--- src/version.c	Thu Jul  5 10:09:34 2007
+***************
+*** 668,669 ****
+--- 668,671 ----
+  {   /* Add new patch number below this line */
++ /**/
++     20,
+  /**/
+
+-- 
+BLACK KNIGHT:  Come on you pansy!
+    [hah] [parry thrust]
+    [ARTHUR chops the BLACK KNIGHT's right arm off]
+ARTHUR:        Victory is mine!  [kneeling]
+               We thank thee Lord, that in thy merc-
+    [Black Knight kicks Arthur in the head while he is praying]
+                                  The Quest for the Holy Grail (Monty Python)
+
+ /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
+///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
+\\\        download, build and distribute -- http://www.A-A-P.org        ///
+ \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///