updated for version 7.4.256

Problem:    Using systemlist() may cause a crash and does not handle NUL
            characters properly.
Solution:   Increase the reference count, allocate memory by length. (Yasuhiro
            Matsumoto)

diff --git a/src/eval.c b/src/eval.c
index 2014deb801ae85bc6b4eaa9f6631921ce956b793..275ef481178b2c29814a6dfcc9e535ac8fdf8701 100644 (file)
--- a/src/eval.c
+++ b/src/eval.c
@@ -18334,16 +18334,17 @@ get_cmd_output_as_rettv(argvars, rettv, retlist)
        for (i = 0; i < len; ++i)
        {
            start = res + i;
-           for (end = start; i < len && *end != NL; ++end)
+           while (i < len && res[i] != NL)
                ++i;
+           end = res + i;
 
-           s = vim_strnsave(start, (int)(end - start));
+           s = alloc((unsigned)(end - start + 1));
            if (s == NULL)
                goto errret;
 
-           for (p = s, end = s + (end - start); p < end; ++p)
-               if (*p == NUL)
-                   *p = NL;
+           for (p = s; start < end; ++p, ++start)
+               *p = *start == NUL ? NL : *start;
+           *p = NUL;
 
            li = listitem_alloc();
            if (li == NULL)
@@ -18356,6 +18357,7 @@ get_cmd_output_as_rettv(argvars, rettv, retlist)
            list_append(list, li);
        }
 
+       ++list->lv_refcount;
        rettv->v_type = VAR_LIST;
        rettv->vval.v_list = list;
        list = NULL;

diff --git a/src/version.c b/src/version.c
index 180a894125a96d72af1a52f7e975c646f1a071ba..1c7c9ddfad1de18c06241d3976e7da9bb34b0756 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    256,
 /**/
     255,
 /**/