# HG changeset patch
# User Bram Moolenaar <Bram@vim.org>
# Date 1578231904 -3600
# Node ID cec4da73951a8d18214e71f878c703a4e5e06026
# Parent  c7102f0d810a01eb68d525f5859a500358a3364a
patch 8.2.0087: crash in command line expansion when out of memory

Commit: https://github.com/vim/vim/commit/61d7c0d52ca40ab8488c36e619d1e46503affd0b
Author: Bram Moolenaar <Bram@vim.org>
Date:   Sun Jan 5 14:38:40 2020 +0100

    patch 8.2.0087: crash in command line expansion when out of memory

    Problem:    Crash in command line expansion when out of memory.
    Solution:   Check for NULL pointer.  Also make ExpandGeneric() static.
                (Dominique Pelle, closes #5437)

diff --git a/src/cmdexpand.c b/src/cmdexpand.c
--- a/src/cmdexpand.c
+++ b/src/cmdexpand.c
@@ -16,6 +16,9 @@
 static int	cmd_showtail;	// Only show path tail in lists ?
 
 static void	set_expand_context(expand_T *xp);
+static int      ExpandGeneric(expand_T *xp, regmatch_T *regmatch,
+			      int *num_file, char_u ***file,
+			      char_u *((*func)(expand_T *, int)), int escaped);
 static int	ExpandFromContext(expand_T *xp, char_u *, int *, char_u ***, int);
 static int	expand_showtail(expand_T *xp);
 static int	expand_shellcmd(char_u *filepat, int *num_file, char_u ***file, int flagsarg);
@@ -2214,7 +2217,7 @@ ExpandFromContext(
  *
  * Returns OK when no problems encountered, FAIL for error (out of memory).
  */
-    int
+    static int
 ExpandGeneric(
     expand_T	*xp,
     regmatch_T	*regmatch,
@@ -2250,6 +2253,13 @@ ExpandGeneric(
 			str = vim_strsave_escaped(str, (char_u *)" \t\\.");
 		    else
 			str = vim_strsave(str);
+		    if (str == NULL)
+		    {
+			FreeWild(count, *file);
+			*num_file = 0;
+			*file = NULL;
+			return FAIL;
+		    }
 		    (*file)[count] = str;
 # ifdef FEAT_MENU
 		    if (func == get_menu_names && str != NULL)
@@ -2268,13 +2278,14 @@ ExpandGeneric(
 	{
 	    if (count == 0)
 		return OK;
-	    *num_file = count;
 	    *file = ALLOC_MULT(char_u *, count);
 	    if (*file == NULL)
 	    {
-		*file = (char_u **)"";
+		*num_file = 0;
+		*file = NULL;
 		return FAIL;
 	    }
+	    *num_file = count;
 	    count = 0;
 	}
     }
@@ -2297,7 +2308,6 @@ ExpandGeneric(
     // they don't show up when getting normal highlight names by ID.
     reset_expand_highlight();
 #endif
-
     return OK;
 }
 
diff --git a/src/proto/cmdexpand.pro b/src/proto/cmdexpand.pro
--- a/src/proto/cmdexpand.pro
+++ b/src/proto/cmdexpand.pro
@@ -8,7 +8,6 @@ char_u *sm_gettail(char_u *s);
 char_u *addstar(char_u *fname, int len, int context);
 void set_cmd_context(expand_T *xp, char_u *str, int len, int col, int use_ccline);
 int expand_cmdline(expand_T *xp, char_u *str, int col, int *matchcount, char_u ***matches);
-int ExpandGeneric(expand_T *xp, regmatch_T *regmatch, int *num_file, char_u ***file, char_u *((*func)(expand_T *, int)), int escaped);
 void globpath(char_u *path, char_u *file, garray_T *ga, int expand_options);
 void f_getcompletion(typval_T *argvars, typval_T *rettv);
 /* vim: set ft=c : */
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -743,6 +743,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    87,
+/**/
     86,
 /**/
     85,