commit a12e40351d1357687e8b5dc3122fffef705bdc08
author Bram Moolenaar <Bram@vim.org> Sat Feb 25 21:37:57 2017 +0100
committer Bram Moolenaar <Bram@vim.org> Sat Feb 25 21:37:57 2017 +0100
tree b4d27ae401a3a6e7458eb95f9a6574959c679503
parent c43a8b8de0676caf8a460b6af1310d7aba8221bb

patch 8.0.0370: invalid memory access when setting wildchar empty

Problem:    Invalid memory access when setting wildchar empty.
Solution:   Avoid going over the end of the option value. (Dominique Pelle,
            closes #1509)  Make option test check all number options with
            empty value.

src/gen_opt_test.vim

diff --git a/src/gen_opt_test.vim b/src/gen_opt_test.vim
index 3970506..745e5ea 100644
--- a/src/gen_opt_test.vim
+++ b/src/gen_opt_test.vim
@@ -46,6 +46,7 @@
       \ 'updatecount': [[0, 1, 8, 9999], [-1]],
       \ 'updatetime': [[0, 1, 8, 9999], [-1]],
       \ 'verbose': [[-1, 0, 1, 8, 9999], []],
+      \ 'wildcharm': [[-1, 0, 100], []],
       \ 'winheight': [[1, 10, 999], [-1, 0]],
       \ 'winminheight': [[0, 1], [-1]],
       \ 'winminwidth': [[0, 1, 10], [-1]],
@@ -137,7 +138,7 @@
       \ 'rubydll': [[], []],
       \ 'tcldll': [[], []],
       \
-      \ 'othernum': [[-1, 0, 100], []],
+      \ 'othernum': [[-1, 0, 100], ['']],
       \ 'otherstring': [['', 'xxx'], []],
       \}
 

src/option.c

diff --git a/src/option.c b/src/option.c
index 5a8af31..d948ac6 100644
--- a/src/option.c
+++ b/src/option.c
@@ -4612,7 +4612,7 @@
 				    || (long *)varp == &p_wcm)
 				&& (*arg == '<'
 				    || *arg == '^'
-				    || ((!arg[1] || vim_iswhite(arg[1]))
+				    || (*arg != NUL && (!arg[1] || vim_iswhite(arg[1]))
 					&& !VIM_ISDIGIT(*arg))))
 			{
 			    value = string_to_key(arg);
@@ -5843,7 +5843,7 @@
 							   opt_flags)) == NULL)
 	    did_set_option(opt_idx, opt_flags, TRUE);
 
-	/* call autocomamnd after handling side effects */
+	/* call autocommand after handling side effects */
 #if defined(FEAT_AUTOCMD) && defined(FEAT_EVAL)
 	if (saved_oldval != NULL)
 	{

src/testdir/test_options.vim

diff --git a/src/testdir/test_options.vim b/src/testdir/test_options.vim
index 623e46c..ac43c1a 100644
--- a/src/testdir/test_options.vim
+++ b/src/testdir/test_options.vim
@@ -29,6 +29,19 @@
   set isfname&
 endfunction
 
+function Test_wildchar()
+  " Empty 'wildchar' used to access invalid memory.
+  call assert_fails('set wildchar=', 'E521:')
+  call assert_fails('set wildchar=abc', 'E521:')
+  set wildchar=<Esc>
+  let a=execute('set wildchar?')
+  call assert_equal("\n  wildchar=<Esc>", a)
+  set wildchar=27
+  let a=execute('set wildchar?')
+  call assert_equal("\n  wildchar=<Esc>", a)
+  set wildchar&
+endfunction
+
 function Test_options()
   let caught = 'ok'
   try

src/version.c

diff --git a/src/version.c b/src/version.c
index 5a60374..1482343 100644
--- a/src/version.c
+++ b/src/version.c
@@ -765,6 +765,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    370,
+/**/
     369,
 /**/
     368,