neovim

commit 1ac588543ded834b254c7f6a73372583ce89f2ea
parent 5db076c7ccfef6732516074252ac4b21b12fc629
Author: zeertzjq <zeertzjq@outlook.com>
Date:   Sat,  7 Oct 2023 06:32:06 +0800

vim-patch:9.0.1995: Invalid memory access with empty 'foldexpr' (#25530)

Problem:  Invalid memory access when 'foldexpr' returns empty string.
Solution: Check for NUL.

closes: vim/vim#13293

https://github.com/vim/vim/commit/a991ce9c083bb8c02b1b1ec34ed35728197050f3
Diffstat:
M
src/nvim/eval.c
 | 
2
+-
M
test/old/testdir/test_fold.vim
 | 
9
+++++++++

2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/src/nvim/eval.c b/src/nvim/eval.c
@@ -1299,7 +1299,7 @@ int eval_foldexpr(win_T *wp, int *cp)
       // If the result is a string, check if there is a non-digit before
       // the number.
       char *s = tv.vval.v_string;
-      if (!ascii_isdigit(*s) && *s != '-') {
+      if (*s != NUL && !ascii_isdigit(*s) && *s != '-') {
         *cp = (uint8_t)(*s++);
       }
       retval = atol(s);
diff --git a/test/old/testdir/test_fold.vim b/test/old/testdir/test_fold.vim
@@ -1569,4 +1569,13 @@ func Test_foldcolumn_linebreak_control_char()
   bwipe!
 endfunc
 
+" This used to cause invalid memory access
+func Test_foldexpr_return_empty_string()
+  new
+  setlocal foldexpr='' foldmethod=expr
+  redraw
+
+  bwipe!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab