From c80ebfff82d539d44815b1d36709ba573e4e38e8 Mon Sep 17 00:00:00 2001
From: cztchoice <cztchoice@gmail.com>
Date: Sun, 12 Jul 2015 08:09:24 +0800
Subject: vim-patch:7.4.736 #2998

Problem:    Invalid memory access.
Solution:   Avoid going over the end of a NUL terminated string. (Dominique
            Pelle)

https://github.com/vim/vim/commit/v7-4-736
---
 src/nvim/regexp.c  |  9 +++++----
 src/nvim/version.c | 42 +++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 46 insertions(+), 5 deletions(-)

(limited to 'src')

diff --git a/src/nvim/regexp.c b/src/nvim/regexp.c
index dddd347822..3ae3f46db3 100644
--- a/src/nvim/regexp.c
+++ b/src/nvim/regexp.c
@@ -1104,7 +1104,7 @@ static int get_coll_element(char_u **pp)
   int l = 1;
   char_u      *p = *pp;
 
-  if (p[1] == '.') {
+  if (p[0] != NUL && p[1] == '.') {
     if (has_mbyte)
       l = (*mb_ptr2len)(p + 2);
     if (p[l + 2] == '.' && p[l + 3] == ']') {
@@ -1156,8 +1156,9 @@ static char_u *skip_anyof(char_u *p)
     else if (*p == '[') {
       if (get_char_class(&p) == CLASS_NONE
           && get_equi_class(&p) == 0
-          && get_coll_element(&p) == 0)
-        ++p;         /* It was not a class name */
+          && get_coll_element(&p) == 0
+          && *p != NUL)
+        ++p;         /* It is not a class name and not NUL */
     } else
       ++p;
   }
@@ -2848,7 +2849,7 @@ static int peekchr(void)
       /*
        * META contains everything that may be magic sometimes,
        * except ^ and $ ("\^" and "\$" are only magic after
-       * "\v").  We now fetch the next character and toggle its
+       * "\V").  We now fetch the next character and toggle its
        * magicness.  Therefore, \ is so meta-magic that it is
        * not in META.
        */
diff --git a/src/nvim/version.c b/src/nvim/version.c
index 757fdf385c..930048af6e 100644
--- a/src/nvim/version.c
+++ b/src/nvim/version.c
@@ -71,9 +71,49 @@ static char *features[] = {
 
 // clang-format off
 static int included_patches[] = {
+  //778,
+  //777,
+  //776,
+  //775,
+  //774,
+  //773,
+  //772,
+  //771,
+  //770,
+  //769,
+  //768,
+  //767,
+  //766,
+  //765,
+  //764,
+  //763,
+  //762,
+  //761,
+  //760,
+  //759,
+  //758,
+  //757,
+  //756,
+  //755,
+  //754,
+  //753,
+  //752,
+  //751,
+  //750,
+  //749,
+  //748,
+  //747,
+  //746,
+  //745,
+  //744,
+  //743,
+  //742,
+  //741,
+  //740,
+  //739,
   //738 NA
   //737,
-  //736,
+  736,
   //735,
   //734,
   //733,
-- 
cgit