patch 8.0.0356: leaking memory when setting 'ttytype'

Problem:    Leaking memory when setting 'ttytype'.
Solution:   Get free_oldval from the right option entry.

src/eval.c

@@ -1898,6 +1898,8 @@ get_lval(
      * Loop until no more [idx] or .key is following.
      */
     lp->ll_tv = &v->di_tv;
+    var1.v_type = VAR_UNKNOWN;
+    var2.v_type = VAR_UNKNOWN;
     while (*p == '[' || (*p == '.' && lp->ll_tv->v_type == VAR_DICT))
     {
 	if (!(lp->ll_tv->v_type == VAR_LIST && lp->ll_tv->vval.v_list != NULL)
@@ -1955,8 +1957,7 @@ get_lval(
 		{
 		    if (!quiet)
 			EMSG(_(e_dictrange));
-		    if (!empty1)
-			clear_tv(&var1);
+		    clear_tv(&var1);
 		    return NULL;
 		}
 		if (rettv != NULL && (rettv->v_type != VAR_LIST
@@ -1964,8 +1965,7 @@ get_lval(
 		{
 		    if (!quiet)
 			EMSG(_("E709: [:] requires a List value"));
-		    if (!empty1)
-			clear_tv(&var1);
+		    clear_tv(&var1);
 		    return NULL;
 		}
 		p = skipwhite(p + 1);
@@ -1976,15 +1976,13 @@ get_lval(
 		    lp->ll_empty2 = FALSE;
 		    if (eval1(&p, &var2, TRUE) == FAIL)	/* recursive! */
 		    {
-			if (!empty1)
-			    clear_tv(&var1);
+			clear_tv(&var1);
 			return NULL;
 		    }
 		    if (get_tv_string_chk(&var2) == NULL)
 		    {
 			/* not a number or string */
-			if (!empty1)
-			    clear_tv(&var1);
+			clear_tv(&var1);
 			clear_tv(&var2);
 			return NULL;
 		    }
@@ -1998,10 +1996,8 @@ get_lval(
 	    {
 		if (!quiet)
 		    EMSG(_(e_missbrac));
-		if (!empty1)
-		    clear_tv(&var1);
-		if (lp->ll_range && !lp->ll_empty2)
-		    clear_tv(&var2);
+		clear_tv(&var1);
+		clear_tv(&var2);
 		return NULL;
 	    }
 
@@ -2064,16 +2060,14 @@ get_lval(
 		{
 		    if (!quiet)
 			EMSG2(_(e_dictkey), key);
-		    if (len == -1)
-			clear_tv(&var1);
+		    clear_tv(&var1);
 		    return NULL;
 		}
 		if (len == -1)
 		    lp->ll_newkey = vim_strsave(key);
 		else
 		    lp->ll_newkey = vim_strnsave(key, len);
-		if (len == -1)
-		    clear_tv(&var1);
+		clear_tv(&var1);
 		if (lp->ll_newkey == NULL)
 		    p = NULL;
 		break;
@@ -2086,8 +2080,7 @@ get_lval(
 		return NULL;
 	    }
 
-	    if (len == -1)
-		clear_tv(&var1);
+	    clear_tv(&var1);
 	    lp->ll_tv = &lp->ll_di->di_tv;
 	}
 	else
@@ -2098,11 +2091,10 @@ get_lval(
 	    if (empty1)
 		lp->ll_n1 = 0;
 	    else
-	    {
+		/* is number or string */
 		lp->ll_n1 = (long)get_tv_number(&var1);
-						    /* is number or string */
-		clear_tv(&var1);
-	    }
+	    clear_tv(&var1);
+
 	    lp->ll_dict = NULL;
 	    lp->ll_list = lp->ll_tv->vval.v_list;
 	    lp->ll_li = list_find(lp->ll_list, lp->ll_n1);
@@ -2116,8 +2108,7 @@ get_lval(
 	    }
 	    if (lp->ll_li == NULL)
 	    {
-		if (lp->ll_range && !lp->ll_empty2)
-		    clear_tv(&var2);
+		clear_tv(&var2);
 		if (!quiet)
 		    EMSGN(_(e_listidx), lp->ll_n1);
 		return NULL;
@@ -2161,6 +2152,7 @@ get_lval(
 	}
     }
 
+    clear_tv(&var1);
     return p;
 }
 

src/gui_gtk_x11.c

@@ -630,6 +630,7 @@ static void gui_gtk_window_clear(GdkWindow *win);
     static void
 gui_gtk3_redraw(int x, int y, int width, int height)
 {
+    /* Range checks are left to gui_redraw_block() */
     gui_redraw_block(Y_2_ROW(y), X_2_COL(x),
 	    Y_2_ROW(y + height - 1), X_2_COL(x + width - 1),
 	    GUI_MON_NOCLEAR);
@@ -684,12 +685,20 @@ draw_event(GtkWidget *widget UNUSED,
 	if (list->status != CAIRO_STATUS_CLIP_NOT_REPRESENTABLE)
 	{
 	    int i;
+
+	    /* First clear all the blocks and then redraw them.  Just in case
+	     * some blocks overlap. */
 	    for (i = 0; i < list->num_rectangles; i++)
 	    {
 		const cairo_rectangle_t rect = list->rectangles[i];
 
-		gui_mch_clear_block(Y_2_ROW(rect.y), 1,
-			Y_2_ROW(rect.y + rect.height - 1), Columns);
+		gui_mch_clear_block(Y_2_ROW((int)rect.y), 0,
+			Y_2_ROW((int)(rect.y + rect.height)) - 1, Columns - 1);
+	    }
+
+	    for (i = 0; i < list->num_rectangles; i++)
+	    {
+		const cairo_rectangle_t rect = list->rectangles[i];
 
 		if (blink_mode)
 		    gui_gtk3_redraw(rect.x, rect.y, rect.width, rect.height);
@@ -6709,8 +6718,14 @@ gui_mch_flush(void)
  * (row2, col2) inclusive.
  */
     void
-gui_mch_clear_block(int row1, int col1, int row2, int col2)
+gui_mch_clear_block(int row1arg, int col1arg, int row2arg, int col2arg)
 {
+
+    int col1 = check_col(col1arg);
+    int col2 = check_col(col2arg);
+    int row1 = check_row(row1arg);
+    int row2 = check_row(row2arg);
+
 #if GTK_CHECK_VERSION(3,0,0)
     if (gtk_widget_get_window(gui.drawarea) == NULL)
 	return;

src/misc1.c

@@ -4028,15 +4028,12 @@ expand_env_esc(
 		 */
 #  if defined(HAVE_GETPWNAM) && defined(HAVE_PWD_H)
 		{
-		    struct passwd *pw;
-
 		    /* Note: memory allocated by getpwnam() is never freed.
 		     * Calling endpwent() apparently doesn't help. */
-		    pw = getpwnam((char *)dst + 1);
-		    if (pw != NULL)
-			var = (char_u *)pw->pw_dir;
-		    else
-			var = NULL;
+		    struct passwd *pw = (*dst == NUL)
+					? NULL : getpwnam((char *)dst + 1);
+
+		    var = (pw == NULL) ? NULL : (char_u *)pw->pw_dir;
 		}
 		if (var == NULL)
 #  endif
@@ -9652,7 +9649,7 @@ expand_wildcards(
 # endif
 	    if (match_file_list(p_wig, (*files)[i], ffname))
 	    {
-		/* remove this matching files from the list */
+		/* remove this matching file from the list */
 		vim_free((*files)[i]);
 		for (j = i; j + 1 < *num_files; ++j)
 		    (*files)[j] = (*files)[j + 1];
@@ -10736,14 +10733,15 @@ has_env_var(char_u *p)
 static int has_special_wildchar(char_u *p);
 
 /*
- * Return TRUE if "p" contains a special wildcard character.
- * Allowing for escaping.
+ * Return TRUE if "p" contains a special wildcard character, one that Vim
+ * cannot expand, requires using a shell.
  */
     static int
 has_special_wildchar(char_u *p)
 {
     for ( ; *p; mb_ptr_adv(p))
     {
+	/* Allow for escaping. */
 	if (*p == '\\' && p[1] != NUL)
 	    ++p;
 	else if (vim_strchr((char_u *)SPECIAL_WILDCHAR, *p) != NULL)

src/option.c

@@ -5936,6 +5936,7 @@ did_set_string_option(
 	    /* Both 'term' and 'ttytype' point to T_NAME, only set the
 	     * P_ALLOCED flag on 'term'. */
 	    opt_idx = findoption((char_u *)"term");
+	    free_oldval = (options[opt_idx].flags & P_ALLOCED);
 	}
     }
 

src/screen.c

@@ -6730,7 +6730,7 @@ win_redr_status(win_T *wp)
 	if (wp->w_buffer->b_p_ro)
 	{
 	    STRCPY(p + len, _("[RO]"));
-	    len += 4;
+	    len += (int)STRLEN(p + len);
 	}
 
 	this_ru_col = ru_col - (Columns - W_WIDTH(wp));

src/testdir/test_assign.vim

@@ -15,7 +15,7 @@ func Test_let_termcap()
   call assert_match('t_te.*^[[yes;', execute("set termcap"))
   let &t_te = old_t_te
 
-  if !has('gui_running')
+  if exists("+t_k1")
     " Key code
     let old_t_k1 = &t_k1
     let &t_k1 = "that"

src/testdir/test_expr.vim

@@ -473,3 +473,8 @@ func Test_setmatches()
   call setmatches(set)
   call assert_equal(exp, getmatches())
 endfunc
+
+func Test_empty_concatenate()
+  call assert_equal('b', 'a'[4:0] . 'b')
+  call assert_equal('b', 'b' . 'a'[4:0])
+endfunc

src/testdir/test_options.vim

@@ -22,6 +22,13 @@ function! Test_whichwrap()
   set whichwrap&
 endfunction
 
+function! Test_isfname()
+  " This used to cause Vim to access uninitialized memory.
+  set isfname=
+  call assert_equal("~X", expand("~X"))
+  set isfname&
+endfunction
+
 function Test_options()
   let caught = 'ok'
   try

src/testdir/test_perl.vim

@@ -26,7 +26,107 @@ EOF
   call assert_equal('abc/def/', getline('$'))
 endfunc
 
-fu <SID>catch_peval(expr)
+func Test_buffer_Delete()
+  new
+  call setline(1, ['a', 'b', 'c', 'd', 'e', 'f', 'g', 'h'])
+  perl $curbuf->Delete(7)
+  perl $curbuf->Delete(2, 5)
+  perl $curbuf->Delete(10)
+  call assert_equal(['a', 'f', 'h'],  getline(1, '$'))
+  bwipe!
+endfunc
+
+func Test_buffer_Append()
+  new
+  perl $curbuf->Append(1, '1')
+  perl $curbuf->Append(2, '2', '3', '4')
+  perl @l = ('5' ..'7')
+  perl $curbuf->Append(0, @l)
+  call assert_equal(['5', '6', '7', '', '1', '2', '3', '4'], getline(1, '$'))
+  bwipe!
+endfunc
+
+func Test_buffer_Set()
+  new
+  call setline(1, ['1', '2', '3', '4', '5'])
+  perl $curbuf->Set(2, 'a', 'b', 'c')
+  perl $curbuf->Set(4, 'A', 'B', 'C')
+  call assert_equal(['1', 'a', 'b', 'A', 'B'], getline(1, '$'))
+  bwipe!
+endfunc
+
+func Test_buffer_Get()
+  new
+  call setline(1, ['1', '2', '3', '4'])
+  call assert_equal('2:3', perleval('join(":", $curbuf->Get(2, 3))'))
+  bwipe!
+endfunc
+
+func Test_buffer_Count()
+  new
+  call setline(1, ['a', 'b', 'c'])
+  call assert_equal(3, perleval('$curbuf->Count()'))
+  bwipe!
+endfunc
+
+func Test_buffer_Name()
+  new
+  call assert_equal('', perleval('$curbuf->Name()'))
+  bwipe!
+  new Xfoo
+  call assert_equal('Xfoo', perleval('$curbuf->Name()'))
+  bwipe!
+endfunc
+
+func Test_buffer_Number()
+  call assert_equal(bufnr('%'), perleval('$curbuf->Number()'))
+endfunc
+
+func Test_window_Cursor()
+  new
+  call setline(1, ['line1', 'line2'])
+  perl $curwin->Cursor(2, 3)
+  call assert_equal('2:3', perleval('join(":", $curwin->Cursor())'))
+  " Col is numbered from 0 in Perl, and from 1 in Vim script.
+  call assert_equal([0, 2, 4, 0], getpos('.'))
+  bwipe!
+endfunc
+
+func Test_window_SetHeight()
+  new
+  perl $curwin->SetHeight(2)
+  call assert_equal(2, winheight(0))
+  bwipe!
+endfunc
+
+func Test_VIM_Windows()
+  new
+  " VIM::Windows() without argument in scalar and list context.
+  perl $winnr = VIM::Windows()
+  perl @winlist = VIM::Windows()
+  perl $curbuf->Append(0, $winnr, scalar(@winlist))
+  call assert_equal(['2', '2', ''], getline(1, '$'))
+
+  " VIM::Windows() with window number argument.
+  perl VIM::Windows(VIM::Eval('winnr()'))->Buffer()->Set(1, 'bar')
+  call assert_equal('bar', getline(1))
+  bwipe!
+endfunc
+
+func Test_VIM_Buffers()
+  new Xbar
+  " VIM::Buffers() without argument in scalar and list context.
+  perl $nbuf = VIM::Buffers()
+  perl @buflist = VIM::Buffers()
+
+  " VIM::Buffers() with argument.
+  perl $mybuf = (VIM::Buffers('Xbar'))[0]
+  perl $mybuf->Append(0, $nbuf, scalar(@buflist))
+  call assert_equal(['2', '2', ''], getline(1, '$'))
+  bwipe!
+endfunc
+
+func <SID>catch_peval(expr)
   try
     call perleval(a:expr)
   catch
@@ -36,7 +136,7 @@ fu <SID>catch_peval(expr)
   return ''
 endfunc
 
-function Test_perleval()
+func Test_perleval()
   call assert_false(perleval('undef'))
 
   " scalar
@@ -75,7 +175,7 @@ function Test_perleval()
   call assert_true(perleval('\\0') =~ 'SCALAR(0x\x\+)')
 endfunc
 
-function Test_perldo()
+func Test_perldo()
   sp __TEST__
   exe 'read ' g:testname
   perldo s/perl/vieux_chameau/g
@@ -99,7 +199,7 @@ function Test_perldo()
   bwipe!
 endfunc
 
-function Test_VIM_package()
+func Test_VIM_package()
   perl VIM::DoCommand('let l:var = "foo"')
   call assert_equal(l:var, 'foo')
 
@@ -108,7 +208,7 @@ function Test_VIM_package()
   call assert_true(&et)
 endfunc
 
-function Test_stdio()
+func Test_stdio()
   redir =>l:out
   perl <<EOF
     VIM::Msg("&VIM::Msg");
@@ -119,7 +219,7 @@ EOF
   call assert_equal(['&VIM::Msg', 'STDOUT', 'STDERR'], split(l:out, "\n"))
 endfunc
 
-function Test_SvREFCNT()
+func Test_SvREFCNT()
   new t
   perl <<--perl
   my ($b, $w);

src/version.c

@@ -764,6 +764,22 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    356,
+/**/
+    355,
+/**/
+    354,
+/**/
+    353,
+/**/
+    352,
+/**/
+    351,
+/**/
+    350,
+/**/
+    349,
 /**/
     348,
 /**/