patch 8.0.1408: crash in setqflist()

Problem:    Crash in setqflist().
Solution:   Check for string to be NULL. (Dominique Pelle, closes #2464)

diff --git a/src/quickfix.c b/src/quickfix.c
index fc65ad4a4570ea7c5b511044cb5f252b19b24edf..d09a334339fe14ddf33bd5bdc236b98aed53d49a 100644 (file)
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -4930,8 +4930,9 @@ qf_get_properties(win_T *wp, dict_T *what, dict_T *retdict)
                        qf_idx = -1;
                }
            }
-           else if ((di->di_tv.v_type == VAR_STRING)
-                   && (STRCMP(di->di_tv.vval.v_string, "$") == 0))
+           else if (di->di_tv.v_type == VAR_STRING
+                           && di->di_tv.vval.v_string != NULL
+                           && STRCMP(di->di_tv.vval.v_string, "$") == 0)
                /* Get the last quickfix list number */
                qf_idx = qi->qf_listcount - 1;
            else
@@ -5226,7 +5227,8 @@ qf_set_properties(qf_info_T *qi, dict_T *what, int action, char_u *title)
                newlist = FALSE;        /* use the specified list */
        }
        else if (di->di_tv.v_type == VAR_STRING
-               && STRCMP(di->di_tv.vval.v_string, "$") == 0)
+                       && di->di_tv.vval.v_string != NULL
+                       && STRCMP(di->di_tv.vval.v_string, "$") == 0)
        {
            if (qi->qf_listcount > 0)
                qf_idx = qi->qf_listcount - 1;

diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
index 61af4dec6412f0149e2629072fb9b488cf7f7f66..2204574998fb9ee60cda082ea4bd168d44d12ae7 100644 (file)
--- a/src/testdir/test_quickfix.vim
+++ b/src/testdir/test_quickfix.vim
@@ -1428,6 +1428,11 @@ func XquickfixSetListWithAct(cchar)
   call assert_fails("call g:Xsetlist(list1, 0)", 'E928:')
 endfunc
 
+func Test_setqflist_invalid_nr()
+  " The following command used to crash Vim
+  call setqflist([], ' ', {'nr' : $XXX_DOES_NOT_EXIST})
+endfunc
+
 func Test_quickfix_set_list_with_act()
   call XquickfixSetListWithAct('c')
   call XquickfixSetListWithAct('l')
@@ -2946,6 +2951,15 @@ func Test_getqflist()
   call Xgetlist_empty_tests('l')
 endfunc
 
+func Test_getqflist_invalid_nr()
+  " The following commands used to crash Vim
+  cexpr ""
+  call getqflist({'nr' : $XXX_DOES_NOT_EXIST_XXX})
+
+  " Cleanup
+  call setqflist([], 'r')
+endfunc
+
 " Tests for the quickfix/location list changedtick
 func Xqftick_tests(cchar)
   call s:setup_commands(a:cchar)

diff --git a/src/version.c b/src/version.c
index c384ff008abe064f8457400cec1b46901e0bf4ec..ed86ef603465b57f6bef2fdf50e7f4e22985fd43 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -771,6 +771,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1408,
 /**/
     1407,
 /**/