From: Christian Brabandt <cb@256bit.org>
Date: Wed, 26 Mar 2025 18:25:57 +0000 (+0100)
Subject: patch 9.1.1242: Crash when evaluating variable name
X-Git-Tag: v9.1.1242^0
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=06774a271a7d728f188175340154361255d6b0a4;p=thirdparty%2Fvim.git

patch 9.1.1242: Crash when evaluating variable name

Problem:  Crash when evaluating variable name (after v9.1.0870)
Solution: calculate the strlen() directly instead of pointer
          arithmetics, fix missing assignment to lp->ll_name_end in
          get_lval() (zeertzjq)

closes: #16972
fixes: vim-airline/vim-airline#2710
related: #16066

Co-authored-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/eval.c b/src/eval.c
index c2856fe72c..923e7a43d9 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -2163,6 +2163,8 @@ get_lval(
 	    }
 	}
 	lp->ll_name = lp->ll_exp_name;
+	if (lp->ll_name != NULL)
+	    lp->ll_name_end = lp->ll_name + STRLEN(lp->ll_name);
     }
     else
     {
@@ -2373,7 +2375,7 @@ set_var_lval(
 
 	    // handle +=, -=, *=, /=, %= and .=
 	    di = NULL;
-	    if (eval_variable(lp->ll_name, (int)(lp->ll_name_end - lp->ll_name),
+	    if (eval_variable(lp->ll_name, (int)STRLEN(lp->ll_name),
 				 lp->ll_sid, &tv, &di, EVAL_VAR_VERBOSE) == OK)
 	    {
 		if (di != NULL && check_typval_is_value(&di->di_tv) == FAIL)
diff --git a/src/version.c b/src/version.c
index 63214b6a21..db9588e6cb 100644
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1242,
 /**/
     1241,
 /**/