commit 62f8b4e18014b259bcde4a2845c602b0a44a3714
author Bram Moolenaar <Bram@vim.org> Sat Jun 11 15:31:47 2016 +0200
committer Bram Moolenaar <Bram@vim.org> Sat Jun 11 15:31:47 2016 +0200
tree 76fc113d90ca646be2c912fca8e4128ca542a822
parent 012270936c3c7df3bba45ad2b48938c23a2fd43a

patch 7.4.1918
Problem:    Not enough testing for parsing viminfo lines.
Solution:   Add test with viminfo lines in bad syntax.  Fix memory leak.

src/ex_cmds.c

diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index 37e8e4c..63af5eb 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -2589,13 +2589,18 @@
 		++p;
 		len = getdigits(&p);
 		buf = alloc((int)(len + 1));
+		if (buf == NULL)
+		    return count;
 		p = buf;
 		for (todo = len; todo > 0; todo -= n)
 		{
 		    if (viminfo_readline(virp) || virp->vir_line[0] != '|'
 						  || virp->vir_line[1] != '<')
+		    {
 			/* file was truncated or garbled */
-			return 0;
+			vim_free(buf);
+			return count;
+		    }
 		    /* Get length of text, excluding |< and NL chars. */
 		    n = STRLEN(virp->vir_line);
 		    while (n > 0 && (virp->vir_line[n - 1] == NL
@@ -2623,7 +2628,7 @@
 		if (viminfo_readline(virp) || virp->vir_line[0] != '|'
 					      || virp->vir_line[1] != '<')
 		    /* file was truncated or garbled */
-		    return 0;
+		    return count;
 		p = virp->vir_line + 2;
 	    }
 	}

src/ex_getln.c

diff --git a/src/ex_getln.c b/src/ex_getln.c
index 87aed90..7f019c6 100644
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -6471,6 +6471,7 @@
 	vim_free(history[type][i].hisstr);
     vim_free(history[type]);
     history[type] = new_hist;
+    vim_free(tot_hist);
 }
 
 /*

src/testdir/test_viminfo.vim

diff --git a/src/testdir/test_viminfo.vim b/src/testdir/test_viminfo.vim
index 1fefba1..9d55600 100644
--- a/src/testdir/test_viminfo.vim
+++ b/src/testdir/test_viminfo.vim
@@ -201,3 +201,22 @@
 
   call delete('Xviminfo')
 endfunc
+
+func Test_viminfo_bad_syntax()
+  let lines = []
+  call add(lines, '|<')  " empty continuation line
+  call add(lines, '|234234234234234324,nothing')
+  call add(lines, '|1+"no comma"')
+  call add(lines, '|1,2,3,4,5,6,7')  " too many items
+  call add(lines, '|1,"string version"')
+  call add(lines, '|1,>x') " bad continuation line
+  call add(lines, '|1,"x') " missing quote
+  call add(lines, '|1,"x\') " trailing backslash
+  call add(lines, '|1,,,,') "trailing comma
+  call add(lines, '|1,>234') " trailing continuation line
+  call writefile(lines, 'Xviminfo')
+  call assert_fails('rviminfo Xviminfo', 'E685:')
+
+  call delete('Xviminfo')
+endfunc
+

src/version.c

diff --git a/src/version.c b/src/version.c
index 684ec76..28b3d62 100644
--- a/src/version.c
+++ b/src/version.c
@@ -754,6 +754,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1918,
+/**/
     1917,
 /**/
     1916,