From ae9212cb5cf101d137c2309120ebd03a8448dc29 Mon Sep 17 00:00:00 2001
From: Karsten Hopp <karsten@fedoraproject.org>
Date: Jan 23 2007 10:51:59 +0000
Subject: patchlevel 183


---

diff --git a/7.0.183 b/7.0.183
new file mode 100644
index 0000000..d135517
--- /dev/null
+++ b/7.0.183
@@ -0,0 +1,163 @@
+To: vim-dev@vim.org
+Subject: patch 7.0.183
+Fcc: outbox
+From: Bram Moolenaar <Bram@moolenaar.net>
+Mime-Version: 1.0
+Content-Type: text/plain; charset=ISO-8859-1
+Content-Transfer-Encoding: 8bit
+------------
+
+Patch 7.0.183
+Problem:    Crash in ":let" when redirecting to a variable that's being
+	    displayed. (Thomas Link)
+Solution:   When redirecting to a variable only do the assignment when
+	    stopping redirection to avoid that setting the variable causes a
+	    freed string to be accessed.
+Files:	    src/eval.c
+
+
+*** ../vim-7.0.182/src/eval.c	Tue Dec  5 10:33:57 2006
+--- src/eval.c	Sun Jan 14 14:20:49 2007
+***************
+*** 898,903 ****
+--- 898,904 ----
+  }
+  
+  static lval_T	*redir_lval = NULL;
++ static garray_T redir_ga;	/* only valid when redir_lval is not NULL */
+  static char_u	*redir_endp = NULL;
+  static char_u	*redir_varname = NULL;
+  
+***************
+*** 932,937 ****
+--- 933,941 ----
+  	return FAIL;
+      }
+  
++     /* The output is stored in growarray "redir_ga" until redirection ends. */
++     ga_init2(&redir_ga, (int)sizeof(char), 500);
++ 
+      /* Parse the variable name (can be a dict or list entry). */
+      redir_endp = get_lval(redir_varname, NULL, redir_lval, FALSE, FALSE, FALSE,
+  							     FNE_CHECK_START);
+***************
+*** 974,1015 ****
+  }
+  
+  /*
+!  * Append "value[len]" to the variable set by var_redir_start().
+   */
+      void
+! var_redir_str(value, len)
+      char_u	*value;
+!     int		len;
+  {
+!     char_u	*val;
+!     typval_T	tv;
+!     int		save_emsg;
+!     int		err;
+  
+      if (redir_lval == NULL)
+  	return;
+  
+!     if (len == -1)
+! 	/* Append the entire string */
+! 	val = vim_strsave(value);
+!     else
+! 	/* Append only the specified number of characters */
+! 	val = vim_strnsave(value, len);
+!     if (val == NULL)
+! 	return;
+! 
+!     tv.v_type = VAR_STRING;
+!     tv.vval.v_string = val;
+  
+!     save_emsg = did_emsg;
+!     did_emsg = FALSE;
+!     set_var_lval(redir_lval, redir_endp, &tv, FALSE, (char_u *)".");
+!     err = did_emsg;
+!     did_emsg |= save_emsg;
+!     if (err)
+  	var_redir_stop();
+- 
+-     vim_free(tv.vval.v_string);
+  }
+  
+  /*
+--- 978,1013 ----
+  }
+  
+  /*
+!  * Append "value[value_len]" to the variable set by var_redir_start().
+!  * The actual appending is postponed until redirection ends, because the value
+!  * appended may in fact be the string we write to, changing it may cause freed
+!  * memory to be used:
+!  *   :redir => foo
+!  *   :let foo
+!  *   :redir END
+   */
+      void
+! var_redir_str(value, value_len)
+      char_u	*value;
+!     int		value_len;
+  {
+!     size_t	len;
+  
+      if (redir_lval == NULL)
+  	return;
+  
+!     if (value_len == -1)
+! 	len = STRLEN(value);	/* Append the entire string */
+!     else
+! 	len = value_len;	/* Append only "value_len" characters */
+  
+!     if (ga_grow(&redir_ga, (int)len) == OK)
+!     {
+! 	mch_memmove((char *)redir_ga.ga_data + redir_ga.ga_len, value, len);
+! 	redir_ga.ga_len += len;
+!     }
+!     else
+  	var_redir_stop();
+  }
+  
+  /*
+***************
+*** 1018,1025 ****
+--- 1016,1034 ----
+      void
+  var_redir_stop()
+  {
++     typval_T	tv;
++ 
+      if (redir_lval != NULL)
+      {
++ 	/* Append the trailing NUL. */
++ 	ga_append(&redir_ga, NUL);
++ 
++ 	/* Assign the text to the variable. */
++ 	tv.v_type = VAR_STRING;
++ 	tv.vval.v_string = redir_ga.ga_data;
++ 	set_var_lval(redir_lval, redir_endp, &tv, FALSE, (char_u *)".");
++ 	vim_free(tv.vval.v_string);
++ 
+  	clear_lval(redir_lval);
+  	vim_free(redir_lval);
+  	redir_lval = NULL;
+*** ../vim-7.0.182/src/version.c	Tue Jan  9 20:29:55 2007
+--- src/version.c	Sun Jan 14 15:23:23 2007
+***************
+*** 668,669 ****
+--- 668,671 ----
+  {   /* Add new patch number below this line */
++ /**/
++     183,
+  /**/
+
+-- 
+How To Keep A Healthy Level Of Insanity:
+16. Have your coworkers address you by your wrestling name, Rock Hard Kim.
+
+ /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
+///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
+\\\        download, build and distribute -- http://www.A-A-P.org        ///
+ \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///