commit 9c0044df7c58f0afc74ed9afd034b55850758da1
author Bram Moolenaar <Bram@vim.org> Fri May 14 20:41:05 2010 +0200
committer Bram Moolenaar <Bram@vim.org> Fri May 14 20:41:05 2010 +0200
tree 77f0abf481bdef1d272961642dcde19194010192
parent 2efbc66e260a9988b5d66c68de940bff6fcdb954

updated for version 7.2.430
Problem:    The ++bad argument is handled wrong, resulting in an invalid
            memory access.
Solution:   Use the bad_char field only for the replacement character, add
            bad_char_idx to store the position. (Dominique Pelle)

src/eval.c

diff --git a/src/eval.c b/src/eval.c
index 43fc7df..ef9b6d1 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -18309,8 +18309,8 @@
 # ifdef FEAT_MBYTE
     if (eap->force_enc != 0)
 	len += (unsigned)STRLEN(eap->cmd + eap->force_enc) + 7;
-    if (eap->bad_char != 0)
-	len += (unsigned)STRLEN(eap->cmd + eap->bad_char) + 7;
+    if (eap->bad_char_idx != 0)
+	len += (unsigned)STRLEN(eap->cmd + eap->bad_char_idx) + 7;
 # endif
 
     newval = alloc(len + 1);
@@ -18334,9 +18334,9 @@
     if (eap->force_enc != 0)
 	sprintf((char *)newval + STRLEN(newval), " ++enc=%s",
 					       eap->cmd + eap->force_enc);
-    if (eap->bad_char != 0)
+    if (eap->bad_char_idx != 0)
 	sprintf((char *)newval + STRLEN(newval), " ++bad=%s",
-					       eap->cmd + eap->bad_char);
+					       eap->cmd + eap->bad_char_idx);
 # endif
     vimvars[VV_CMDARG].vv_str = newval;
     return oldval;

src/ex_cmds.h

diff --git a/src/ex_cmds.h b/src/ex_cmds.h
index a5a9e12..eb47297 100644
--- a/src/ex_cmds.h
+++ b/src/ex_cmds.h
@@ -1152,7 +1152,8 @@
     int		force_ff;	/* ++ff= argument (index in cmd[]) */
 #ifdef FEAT_MBYTE
     int		force_enc;	/* ++enc= argument (index in cmd[]) */
-    int		bad_char;	/* ++bad= argument (index in cmd[]) */
+    int		bad_char_idx;	/* ++bad= argument (index in cmd[]) */
+    int		bad_char;	/* BAD_KEEP, BAD_DROP or replacement char */
 #endif
 #ifdef FEAT_USR_CMDS
     int		useridx;	/* user command index */

src/ex_docmd.c

diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index dbb0584..748e3bc 100644
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -4739,7 +4739,7 @@
     else if (STRNCMP(arg, "bad", 3) == 0)
     {
 	arg += 3;
-	pp = &eap->bad_char;
+	pp = &eap->bad_char_idx;
     }
 #endif
 
@@ -4770,7 +4770,7 @@
     {
 	/* Check ++bad= argument.  Must be a single-byte character, "keep" or
 	 * "drop". */
-	p = eap->cmd + eap->bad_char;
+	p = eap->cmd + eap->bad_char_idx;
 	if (STRICMP(p, "keep") == 0)
 	    eap->bad_char = BAD_KEEP;
 	else if (STRICMP(p, "drop") == 0)

src/version.c

diff --git a/src/version.c b/src/version.c
index dc706e7..111adb5 100644
--- a/src/version.c
+++ b/src/version.c
@@ -682,6 +682,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    430,
+/**/
     429,
 /**/
     428,