From 8f1723de4735e437b4ced3be95d6582e713c3d7d Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Sun, 12 May 2013 20:36:14 +0200
Subject: [PATCH] updated for version 7.3.942 Problem:    Python: SEGV in
 Buffer functions. Solution:   Call CheckBuffer() at the right time. (ZyX)

---
 src/if_py_both.h | 25 ++++++++++++++++++-------
 src/if_python.c  |  8 ++------
 src/if_python3.c |  6 ++++++
 src/version.c    |  2 ++
 4 files changed, 28 insertions(+), 13 deletions(-)

diff --git a/src/if_py_both.h b/src/if_py_both.h
index d8b0f70d9..681b7a172 100644
--- a/src/if_py_both.h
+++ b/src/if_py_both.h
@@ -2391,6 +2391,9 @@ RBItem(BufferObject *self, PyInt n, PyInt start, PyInt end)
     if (CheckBuffer(self))
 	return NULL;
 
+    if (end == -1)
+	end = self->buf->b_ml.ml_line_count;
+
     if (n < 0 || n > end - start)
     {
 	PyErr_SetString(PyExc_IndexError, _("line number out of range"));
@@ -2408,6 +2411,9 @@ RBSlice(BufferObject *self, PyInt lo, PyInt hi, PyInt start, PyInt end)
     if (CheckBuffer(self))
 	return NULL;
 
+    if (end == -1)
+	end = self->buf->b_ml.ml_line_count;
+
     size = end - start + 1;
 
     if (lo < 0)
@@ -2432,6 +2438,9 @@ RBAsItem(BufferObject *self, PyInt n, PyObject *val, PyInt start, PyInt end, PyI
     if (CheckBuffer(self))
 	return -1;
 
+    if (end == -1)
+	end = self->buf->b_ml.ml_line_count;
+
     if (n < 0 || n > end - start)
     {
 	PyErr_SetString(PyExc_IndexError, _("line number out of range"));
@@ -2457,6 +2466,9 @@ RBAsSlice(BufferObject *self, PyInt lo, PyInt hi, PyObject *val, PyInt start, Py
     if (CheckBuffer(self))
 	return -1;
 
+    if (end == -1)
+	end = self->buf->b_ml.ml_line_count;
+
     /* Sort out the slice range */
     size = end - start + 1;
 
@@ -2493,6 +2505,9 @@ RBAppend(BufferObject *self, PyObject *args, PyInt start, PyInt end, PyInt *new_
     if (CheckBuffer(self))
 	return NULL;
 
+    if (end == -1)
+	end = self->buf->b_ml.ml_line_count;
+
     max = n = end - start + 1;
 
     if (!PyArg_ParseTuple(args, "O|n", &lines, &n))
@@ -2700,15 +2715,13 @@ BufferLength(PyObject *self)
     static PyObject *
 BufferItem(PyObject *self, PyInt n)
 {
-    return RBItem((BufferObject *)(self), n, 1,
-		  (PyInt)((BufferObject *)(self))->buf->b_ml.ml_line_count);
+    return RBItem((BufferObject *)(self), n, 1, -1);
 }
 
     static PyObject *
 BufferSlice(PyObject *self, PyInt lo, PyInt hi)
 {
-    return RBSlice((BufferObject *)(self), lo, hi, 1,
-		   (PyInt)((BufferObject *)(self))->buf->b_ml.ml_line_count);
+    return RBSlice((BufferObject *)(self), lo, hi, 1, -1);
 }
 
     static PyObject *
@@ -2732,9 +2745,7 @@ BufferAttr(BufferObject *this, char *name)
     static PyObject *
 BufferAppend(PyObject *self, PyObject *args)
 {
-    return RBAppend((BufferObject *)(self), args, 1,
-		    (PyInt)((BufferObject *)(self))->buf->b_ml.ml_line_count,
-		    NULL);
+    return RBAppend((BufferObject *)(self), args, 1, -1, NULL);
 }
 
     static PyObject *
diff --git a/src/if_python.c b/src/if_python.c
index 8e3621caf..dda65affc 100644
--- a/src/if_python.c
+++ b/src/if_python.c
@@ -1073,17 +1073,13 @@ BufferGetattr(PyObject *self, char *name)
     static PyInt
 BufferAssItem(PyObject *self, PyInt n, PyObject *val)
 {
-    return RBAsItem((BufferObject *)(self), n, val, 1,
-		     (PyInt)((BufferObject *)(self))->buf->b_ml.ml_line_count,
-		     NULL);
+    return RBAsItem((BufferObject *)(self), n, val, 1, -1, NULL);
 }
 
     static PyInt
 BufferAssSlice(PyObject *self, PyInt lo, PyInt hi, PyObject *val)
 {
-    return RBAsSlice((BufferObject *)(self), lo, hi, val, 1,
-		      (PyInt)((BufferObject *)(self))->buf->b_ml.ml_line_count,
-		      NULL);
+    return RBAsSlice((BufferObject *)(self), lo, hi, val, 1, -1, NULL);
 }
 
 static PySequenceMethods RangeAsSeq = {
diff --git a/src/if_python3.c b/src/if_python3.c
index 77d7cd3ce..da0867b7e 100644
--- a/src/if_python3.c
+++ b/src/if_python3.c
@@ -1110,6 +1110,9 @@ BufferSubscript(PyObject *self, PyObject* idx)
     {
 	Py_ssize_t start, stop, step, slicelen;
 
+	if (CheckBuffer((BufferObject *) self))
+	    return NULL;
+
 	if (PySlice_GetIndicesEx((PyObject *)idx,
 	      (Py_ssize_t)((BufferObject *)(self))->buf->b_ml.ml_line_count+1,
 	      &start, &stop,
@@ -1139,6 +1142,9 @@ BufferAsSubscript(PyObject *self, PyObject* idx, PyObject* val)
     {
 	Py_ssize_t start, stop, step, slicelen;
 
+	if (CheckBuffer((BufferObject *) self))
+	    return -1;
+
 	if (PySlice_GetIndicesEx((PyObject *)idx,
 	      (Py_ssize_t)((BufferObject *)(self))->buf->b_ml.ml_line_count+1,
 	      &start, &stop,
diff --git a/src/version.c b/src/version.c
index 8bc257f5f..be2138c05 100644
--- a/src/version.c
+++ b/src/version.c
@@ -728,6 +728,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    942,
 /**/
     941,
 /**/
-- 
2.40.0