vim-patch:7.4.1664

Problem:    Crash in :cgetexpr.
Solution:   Check for NULL pointer. (Dominique) Add a test.

https://github.com/vim/vim/commit/89c64d557dbe0bacfdd7b2872411b00cc1523d85

3 files changed, 10 insertions, 2 deletions

diff --git a/src/nvim/quickfix.c b/src/nvim/quickfix.c
index 6bb863985e..188de92809 100644
--- a/src/nvim/quickfix.c
+++ b/src/nvim/quickfix.c
@@ -483,8 +483,10 @@ qf_init_ext (
           p_str += len;
         } else if (tv->v_type == VAR_LIST) {
           /* Get the next line from the supplied list */
-          while (p_li && p_li->li_tv.v_type != VAR_STRING)
+          while (p_li && (p_li->li_tv.v_type != VAR_STRING
+                          || p_li->li_tv.vval.v_string == NULL)) {
             p_li = p_li->li_next;               /* Skip non-string items */
+          }
 
           if (!p_li)                            /* End of the list */
             break;
diff --git a/src/nvim/version.c b/src/nvim/version.c
index b286f03301..d0b802418d 100644
--- a/src/nvim/version.c
+++ b/src/nvim/version.c
@@ -780,7 +780,7 @@ static int included_patches[] = {
   // 1667 NA
   // 1666 NA
   // 1665 NA
-  // 1664,
+  1664,
   1663,
   // 1662 NA
   // 1661 NA
diff --git a/test/functional/legacy/quickfix_spec.lua b/test/functional/legacy/quickfix_spec.lua
index 5e5aefc4e6..5787ff8ff3 100644
--- a/test/functional/legacy/quickfix_spec.lua
+++ b/test/functional/legacy/quickfix_spec.lua
@@ -540,6 +540,12 @@ describe('helpgrep', function()
     call('Test_caddbuffer_to_empty')
     expected_empty()
   end)
+
+  it('cgetexpr does not crash with a NULL element in a list', function()
+    execute('cgetexpr [$x]')
+    -- Still alive?
+    eq(2, eval('1+1'))
+  end)
 end)
 
 describe('errorformat', function()