To: vim-dev@vim.org
Subject: Patch 7.2.273
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 7.2.273
Problem:    Crash with redir to unknown array. (Christian Brabandt)
Solution:   Don't assign the redir result when there was an error.
Files:	    src/eval.c


*** ../vim-7.2.272/src/eval.c	2009-09-30 15:15:33.000000000 +0200
--- src/eval.c	2009-11-03 12:05:07.000000000 +0100
***************
*** 988,1000 ****
      int		err;
      typval_T	tv;
  
!     /* Make sure a valid variable name is specified */
      if (!eval_isnamec1(*name))
      {
  	EMSG(_(e_invarg));
  	return FAIL;
      }
  
      redir_varname = vim_strsave(name);
      if (redir_varname == NULL)
  	return FAIL;
--- 988,1001 ----
      int		err;
      typval_T	tv;
  
!     /* Catch a bad name early. */
      if (!eval_isnamec1(*name))
      {
  	EMSG(_(e_invarg));
  	return FAIL;
      }
  
+     /* Make a copy of the name, it is used in redir_lval until redir ends. */
      redir_varname = vim_strsave(name);
      if (redir_varname == NULL)
  	return FAIL;
***************
*** 1019,1024 ****
--- 1020,1026 ----
  	    EMSG(_(e_trailing));
  	else
  	    EMSG(_(e_invarg));
+ 	redir_endp = NULL;  /* don't store a value, only cleanup */
  	var_redir_stop();
  	return FAIL;
      }
***************
*** 1037,1042 ****
--- 1039,1045 ----
      did_emsg |= save_emsg;
      if (err)
      {
+ 	redir_endp = NULL;  /* don't store a value, only cleanup */
  	var_redir_stop();
  	return FAIL;
      }
***************
*** 1085,1090 ****
--- 1088,1094 ----
  
  /*
   * Stop redirecting command output to a variable.
+  * Frees the allocated memory.
   */
      void
  var_redir_stop()
***************
*** 1093,1106 ****
  
      if (redir_lval != NULL)
      {
! 	/* Append the trailing NUL. */
! 	ga_append(&redir_ga, NUL);
  
! 	/* Assign the text to the variable. */
! 	tv.v_type = VAR_STRING;
! 	tv.vval.v_string = redir_ga.ga_data;
! 	set_var_lval(redir_lval, redir_endp, &tv, FALSE, (char_u *)".");
! 	vim_free(tv.vval.v_string);
  
  	clear_lval(redir_lval);
  	vim_free(redir_lval);
--- 1097,1114 ----
  
      if (redir_lval != NULL)
      {
! 	/* If there was no error: assign the text to the variable. */
! 	if (redir_endp != NULL)
! 	{
! 	    ga_append(&redir_ga, NUL);  /* Append the trailing NUL. */
! 	    tv.v_type = VAR_STRING;
! 	    tv.vval.v_string = redir_ga.ga_data;
! 	    set_var_lval(redir_lval, redir_endp, &tv, FALSE, (char_u *)".");
! 	}
  
! 	/* free the collected output */
! 	vim_free(redir_ga.ga_data);
! 	redir_ga.ga_data = NULL;
  
  	clear_lval(redir_lval);
  	vim_free(redir_lval);
*** ../vim-7.2.272/src/version.c	2009-11-03 13:06:03.000000000 +0100
--- src/version.c	2009-11-03 14:24:06.000000000 +0100
***************
*** 678,679 ****
--- 678,681 ----
  {   /* Add new patch number below this line */
+ /**/
+     273,
  /**/

-- 
Permission is granted to read this message out aloud on Kings Cross Road,
London, under the condition that the orator is properly dressed.

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\        download, build and distribute -- http://www.A-A-P.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///