# HG changeset patch
# User Christian Brabandt <cb@256bit.org>
# Date 1465652705 -7200
# Node ID 79cb08f0d81224fc13f9e96a48452ac4dabd5332
# Parent  6ff13c33ae11178f9bb3354d01a398d67702d9cd
commit https://github.com/vim/vim/commit/62f8b4e18014b259bcde4a2845c602b0a44a3714
Author: Bram Moolenaar <Bram@vim.org>
Date:   Sat Jun 11 15:31:47 2016 +0200

    patch 7.4.1918
    Problem:    Not enough testing for parsing viminfo lines.
    Solution:   Add test with viminfo lines in bad syntax.  Fix memory leak.

diff --git a/src/ex_cmds.c b/src/ex_cmds.c
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -2589,13 +2589,18 @@ barline_parse(vir_T *virp, char_u *text,
 		++p;
 		len = getdigits(&p);
 		buf = alloc((int)(len + 1));
+		if (buf == NULL)
+		    return count;
 		p = buf;
 		for (todo = len; todo > 0; todo -= n)
 		{
 		    if (viminfo_readline(virp) || virp->vir_line[0] != '|'
 						  || virp->vir_line[1] != '<')
+		    {
 			/* file was truncated or garbled */
-			return 0;
+			vim_free(buf);
+			return count;
+		    }
 		    /* Get length of text, excluding |< and NL chars. */
 		    n = STRLEN(virp->vir_line);
 		    while (n > 0 && (virp->vir_line[n - 1] == NL
@@ -2623,7 +2628,7 @@ barline_parse(vir_T *virp, char_u *text,
 		if (viminfo_readline(virp) || virp->vir_line[0] != '|'
 					      || virp->vir_line[1] != '<')
 		    /* file was truncated or garbled */
-		    return 0;
+		    return count;
 		p = virp->vir_line + 2;
 	    }
 	}
diff --git a/src/ex_getln.c b/src/ex_getln.c
--- a/src/ex_getln.c
+++ b/src/ex_getln.c
@@ -6471,6 +6471,7 @@ merge_history(int type)
 	vim_free(history[type][i].hisstr);
     vim_free(history[type]);
     history[type] = new_hist;
+    vim_free(tot_hist);
 }
 
 /*
diff --git a/src/testdir/test_viminfo.vim b/src/testdir/test_viminfo.vim
--- a/src/testdir/test_viminfo.vim
+++ b/src/testdir/test_viminfo.vim
@@ -201,3 +201,22 @@ func Test_viminfo_encoding()
 
   call delete('Xviminfo')
 endfunc
+
+func Test_viminfo_bad_syntax()
+  let lines = []
+  call add(lines, '|<')  " empty continuation line
+  call add(lines, '|234234234234234324,nothing')
+  call add(lines, '|1+"no comma"')
+  call add(lines, '|1,2,3,4,5,6,7')  " too many items
+  call add(lines, '|1,"string version"')
+  call add(lines, '|1,>x') " bad continuation line
+  call add(lines, '|1,"x') " missing quote
+  call add(lines, '|1,"x\') " trailing backslash
+  call add(lines, '|1,,,,') "trailing comma
+  call add(lines, '|1,>234') " trailing continuation line
+  call writefile(lines, 'Xviminfo')
+  call assert_fails('rviminfo Xviminfo', 'E685:')
+
+  call delete('Xviminfo')
+endfunc
+
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -754,6 +754,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1918,
+/**/
     1917,
 /**/
     1916,