patch 7.4.1465
Problem:    Coverity reported possible use of NULL pointer when using buffer
            output with JSON mode.
Solution:   Make it actually possible to use JSON mode with a buffer.
            Re-encode the JSON to append it to the buffer.
diff --git a/src/channel.c b/src/channel.c
index a1ea6b8..b6a968b 100644
--- a/src/channel.c
+++ b/src/channel.c
@@ -926,8 +926,9 @@
 
     if ((opt->jo_set & JO_OUT_IO) && opt->jo_io[PART_OUT] == JIO_BUFFER)
     {
-	/* writing output to a buffer. Force mode to NL. */
-	channel->ch_part[PART_OUT].ch_mode = MODE_NL;
+	/* writing output to a buffer. Default mode is NL. */
+	if (!(opt->jo_set & JO_OUT_MODE))
+	    channel->ch_part[PART_OUT].ch_mode = MODE_NL;
 	channel->ch_part[PART_OUT].ch_buffer =
 				       find_buffer(opt->jo_io_name[PART_OUT]);
 	ch_logs(channel, "writing to buffer '%s'",
@@ -1560,32 +1561,38 @@
 	    u_sync(TRUE);
 	    u_save(lnum, lnum + 1);
 
-	    ml_append(lnum, msg, 0, FALSE);
-	    appended_lines_mark(lnum, 1L);
-	    curbuf = save_curbuf;
-
-	    if (buffer->b_nwindows > 0)
+	    if (msg == NULL)
+		/* JSON or JS mode: re-encode the message. */
+		msg = json_encode(listtv, ch_mode);
+	    if (msg != NULL)
 	    {
-		win_T	*wp;
-		win_T	*save_curwin;
+		ml_append(lnum, msg, 0, FALSE);
+		appended_lines_mark(lnum, 1L);
+		curbuf = save_curbuf;
 
-		FOR_ALL_WINDOWS(wp)
+		if (buffer->b_nwindows > 0)
 		{
-		    if (wp->w_buffer == buffer
-			    && wp->w_cursor.lnum == lnum
-			    && wp->w_cursor.col == 0)
+		    win_T	*wp;
+		    win_T	*save_curwin;
+
+		    FOR_ALL_WINDOWS(wp)
 		    {
-			++wp->w_cursor.lnum;
-			save_curwin = curwin;
-			curwin = wp;
-			curbuf = curwin->w_buffer;
-			scroll_cursor_bot(0, FALSE);
-			curwin = save_curwin;
-			curbuf = curwin->w_buffer;
+			if (wp->w_buffer == buffer
+				&& wp->w_cursor.lnum == lnum
+				&& wp->w_cursor.col == 0)
+			{
+			    ++wp->w_cursor.lnum;
+			    save_curwin = curwin;
+			    curwin = wp;
+			    curbuf = curwin->w_buffer;
+			    scroll_cursor_bot(0, FALSE);
+			    curwin = save_curwin;
+			    curbuf = curwin->w_buffer;
+			}
 		    }
+		    redraw_buf_later(buffer, VALID);
+		    channel_need_redraw = TRUE;
 		}
-		redraw_buf_later(buffer, VALID);
-		channel_need_redraw = TRUE;
 	    }
 	}
 	if (callback != NULL)
diff --git a/src/testdir/test_channel.vim b/src/testdir/test_channel.vim
index 0fded01..7794994 100644
--- a/src/testdir/test_channel.vim
+++ b/src/testdir/test_channel.vim
@@ -426,6 +426,32 @@
   endtry
 endfunc
 
+func Test_pipe_to_buffer_json()
+  if !has('job')
+    return
+  endif
+  call ch_log('Test_pipe_to_buffer_json()')
+  let job = job_start(s:python . " test_channel_pipe.py",
+	\ {'out-io': 'buffer', 'out-mode': 'json'})
+  call assert_equal("run", job_status(job))
+  try
+    let handle = job_getchannel(job)
+    call ch_sendraw(handle, "echo [0, \"hello\"]\n")
+    call ch_sendraw(handle, "echo [-2, 12.34]\n")
+    exe ch_getbufnr(handle, "out") . 'sbuf'
+    for i in range(100)
+      sleep 10m
+      if line('$') >= 3
+	break
+      endif
+    endfor
+    call assert_equal(['Reading from channel output...', '[0,"hello"]', '[-2,12.34]'], getline(1, '$'))
+    bwipe!
+  finally
+    call job_stop(job)
+  endtry
+endfunc
+
 """"""""""
 
 let s:unletResponse = ''
diff --git a/src/version.c b/src/version.c
index 24a27cc..9b58329 100644
--- a/src/version.c
+++ b/src/version.c
@@ -744,6 +744,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1465,
+/**/
     1464,
 /**/
     1463,