From: Bram Moolenaar <Bram@vim.org>
Date: Fri, 11 Apr 2014 08:22:53 +0000 (+0200)
Subject: updated for version 7.4.256
X-Git-Tag: v7.4.256
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=b21a29be56fb0e125d9f736bfdef8dde5a1ceae0;p=vim

updated for version 7.4.256
Problem:    Using systemlist() may cause a crash and does not handle NUL
            characters properly.
Solution:   Increase the reference count, allocate memory by length. (Yasuhiro
            Matsumoto)
---

diff --git a/src/eval.c b/src/eval.c
index 2014deb80..275ef4811 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -18334,16 +18334,17 @@ get_cmd_output_as_rettv(argvars, rettv, retlist)
 	for (i = 0; i < len; ++i)
 	{
 	    start = res + i;
-	    for (end = start; i < len && *end != NL; ++end)
+	    while (i < len && res[i] != NL)
 		++i;
+	    end = res + i;
 
-	    s = vim_strnsave(start, (int)(end - start));
+	    s = alloc((unsigned)(end - start + 1));
 	    if (s == NULL)
 		goto errret;
 
-	    for (p = s, end = s + (end - start); p < end; ++p)
-		if (*p == NUL)
-		    *p = NL;
+	    for (p = s; start < end; ++p, ++start)
+		*p = *start == NUL ? NL : *start;
+	    *p = NUL;
 
 	    li = listitem_alloc();
 	    if (li == NULL)
@@ -18356,6 +18357,7 @@ get_cmd_output_as_rettv(argvars, rettv, retlist)
 	    list_append(list, li);
 	}
 
+	++list->lv_refcount;
 	rettv->v_type = VAR_LIST;
 	rettv->vval.v_list = list;
 	list = NULL;
diff --git a/src/version.c b/src/version.c
index 180a89412..1c7c9ddfa 100644
--- a/src/version.c
+++ b/src/version.c
@@ -734,6 +734,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    256,
 /**/
     255,
 /**/