From: Bram Moolenaar <Bram@vim.org>
Date: Sun, 27 Mar 2016 16:44:40 +0000 (+0200)
Subject: patch 7.4.1664
X-Git-Tag: v7.4.1664
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=89c64d557dbe0bacfdd7b2872411b00cc1523d85;p=vim

patch 7.4.1664
Problem:    Crash in :cgetexpr.
Solution:   Check for NULL pointer. (Dominique) Add a test.
---

diff --git a/src/quickfix.c b/src/quickfix.c
index c2ff55a8c..00762bda4 100644
--- a/src/quickfix.c
+++ b/src/quickfix.c
@@ -532,7 +532,8 @@ qf_init_ext(
 		else if (tv->v_type == VAR_LIST)
 		{
 		    /* Get the next line from the supplied list */
-		    while (p_li && p_li->li_tv.v_type != VAR_STRING)
+		    while (p_li && (p_li->li_tv.v_type != VAR_STRING
+				|| p_li->li_tv.vval.v_string == NULL))
 			p_li = p_li->li_next;	/* Skip non-string items */
 
 		    if (!p_li)			/* End of the list */
diff --git a/src/testdir/test_quickfix.vim b/src/testdir/test_quickfix.vim
index 3908ce093..8da1b6fff 100644
--- a/src/testdir/test_quickfix.vim
+++ b/src/testdir/test_quickfix.vim
@@ -692,3 +692,8 @@ func Test_caddbuffer_to_empty()
   endtry
   quit!
 endfunc
+
+func Test_cgetexpr_works()
+  " this must not crash Vim
+  cgetexpr [$x]
+endfunc
diff --git a/src/version.c b/src/version.c
index f21fb6bb1..e925e413a 100644
--- a/src/version.c
+++ b/src/version.c
@@ -748,6 +748,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1664,
 /**/
     1663,
 /**/