patch 7.4.1664

Problem:    Crash in :cgetexpr.
Solution:   Check for NULL pointer. (Dominique) Add a test.

diff --git a/src/quickfix.c b/src/quickfix.c
index c2ff55a8c0e9ec79a7e735ee44271b95ccf69939..00762bda457f063f8218ac16ab399a5b70e55c3e 100644 (file)
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -532,7 +532,8 @@ qf_init_ext(
                else if (tv->v_type == VAR_LIST)
                {
                    /* Get the next line from the supplied list */
-                   while (p_li && p_li->li_tv.v_type != VAR_STRING)
+                   while (p_li && (p_li->li_tv.v_type != VAR_STRING
+                               || p_li->li_tv.vval.v_string == NULL))
                        p_li = p_li->li_next;   /* Skip non-string items */
 
                    if (!p_li)                  /* End of the list */

diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
index 3908ce0938d6b995b20538732ac12b63e64a1126..8da1b6fff4b4643f683cc019dc7078f5e250d890 100644 (file)
--- a/src/testdir/test_quickfix.vim
+++ b/src/testdir/test_quickfix.vim
@@ -692,3 +692,8 @@ func Test_caddbuffer_to_empty()
   endtry
   quit!
 endfunc
+
+func Test_cgetexpr_works()
+  " this must not crash Vim
+  cgetexpr [$x]
+endfunc

diff --git a/src/version.c b/src/version.c
index f21fb6bb1552b1a2cc8cdbabaa3198589e09d90c..e925e413a9ca6f9c98e1edd39e1c8919931354df 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -748,6 +748,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1664,
 /**/
     1663,
 /**/