patch 9.0.1995: Invalid memory access with empty 'foldexpr'

Problem:  Invalid memory access when 'foldexpr' returns empty string.
Solution: Check for NUL.

closes: #13293

Signed-off-by: Christian Brabandt <cb@256bit.org>
Co-authored-by: zeertzjq <zeertzjq@outlook.com>

diff --git a/src/eval.c b/src/eval.c
index 19ab01561de45d5f05d98cc20e458b22df79c952..a9f7112f2deaa7375287b24f29638e898690e830 100644 (file)
--- a/src/eval.c
+++ b/src/eval.c
@@ -968,7 +968,7 @@ eval_foldexpr(win_T *wp, int *cp)
            // If the result is a string, check if there is a non-digit before
            // the number.
            s = tv.vval.v_string;
-           if (!VIM_ISDIGIT(*s) && *s != '-')
+           if (*s != NUL && !VIM_ISDIGIT(*s) && *s != '-')
                *cp = *s++;
            retval = atol((char *)s);
        }

diff --git a/src/testdir/test_fold.vim b/src/testdir/test_fold.vim
index 398a0c2d71069922f8ca0d3fa69046028da47a0d..cb29d43d54ed861882296f194bb01efc899733d3 100644 (file)
--- a/src/testdir/test_fold.vim
+++ b/src/testdir/test_fold.vim
@@ -1769,4 +1769,13 @@ func Test_foldcolumn_linebreak_control_char()
   bwipe!
 endfunc
 
+" This used to cause invalid memory access
+func Test_foldexpr_return_empty_string()
+  new
+  setlocal foldexpr='' foldmethod=expr
+  redraw
+
+  bwipe!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index 057cae580acdea40f3eab1947c1b45466e7b13f4..ce13dcc776284aa1330dfcad69a0561c89f9fb41 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1995,
 /**/
     1994,
 /**/