patch 9.0.0338: return value of list_append_list() not always checkedv9.0.0338

Problem:    Return value of list_append_list() not always checked.
Solution:   Check return value and handle failure.

5 files changed, 44 insertions, 11 deletions

diff --git a/src/evalfunc.c b/src/evalfunc.c
index be1b2e71f2..9cbd413405 100644
--- a/src/evalfunc.c
+++ b/src/evalfunc.c
@@ -4811,9 +4811,12 @@ f_getchangelist(typval_T *argvars, typval_T *rettv)
     l = list_alloc();
     if (l == NULL)
 	return;
-
     if (list_append_list(rettv->vval.v_list, l) == FAIL)
+    {
+	vim_free(l);
 	return;
+    }
+
     /*
      * The current window change list index tracks only the position for the
      * current buffer. For other buffers use the stored index for the current
@@ -5045,9 +5048,12 @@ f_getjumplist(typval_T *argvars, typval_T *rettv)
     l = list_alloc();
     if (l == NULL)
 	return;
-
     if (list_append_list(rettv->vval.v_list, l) == FAIL)
+    {
+	vim_free(l);
 	return;
+    }
+
     list_append_number(rettv->vval.v_list, (varnumber_T)wp->w_jumplistidx);
 
     for (i = 0; i < wp->w_jumplistlen; ++i)
diff --git a/src/evalwindow.c b/src/evalwindow.c
index 906c269789..7a019627fb 100644
--- a/src/evalwindow.c
+++ b/src/evalwindow.c
@@ -261,7 +261,7 @@ find_tabwin(
 }
 
 /*
- * Get the layout of the given tab page for winlayout().
+ * Get the layout of the given tab page for winlayout() and add it to "l".
  */
     static void
 get_framelayout(frame_T *fr, list_T *l, int outer)
@@ -281,7 +281,11 @@ get_framelayout(frame_T *fr, list_T *l, int outer)
 	fr_list = list_alloc();
 	if (fr_list == NULL)
 	    return;
-	list_append_list(l, fr_list);
+	if (list_append_list(l, fr_list) == FAIL)
+	{
+	    vim_free(fr_list);
+	    return;
+	}
     }
 
     if (fr->fr_layout == FR_LEAF)
@@ -300,7 +304,12 @@ get_framelayout(frame_T *fr, list_T *l, int outer)
 	win_list = list_alloc();
 	if (win_list == NULL)
 	    return;
-	list_append_list(fr_list, win_list);
+	if (list_append_list(fr_list, win_list) == FAIL)
+	{
+	    vim_free(win_list);
+	    return;
+	}
+
 	child = fr->fr_child;
 	while (child != NULL)
 	{
diff --git a/src/list.c b/src/list.c
index 7bc34db7f9..5e70f2111b 100644
--- a/src/list.c
+++ b/src/list.c
@@ -1076,8 +1076,12 @@ list2items(typval_T *argvars, typval_T *rettv)
 
 	if (l2 == NULL)
 	    break;
-	if (list_append_list(rettv->vval.v_list, l2) == FAIL
-		|| list_append_number(l2, idx) == FAIL
+	if (list_append_list(rettv->vval.v_list, l2) == FAIL)
+	{
+	    vim_free(l2);
+	    break;
+	}
+	if (list_append_number(l2, idx) == FAIL
 		|| list_append_tv(l2, &li->li_tv) == FAIL)
 	    break;
     }
@@ -1108,8 +1112,12 @@ string2items(typval_T *argvars, typval_T *rettv)
 	l2 = list_alloc();
 	if (l2 == NULL)
 	    break;
-	if (list_append_list(rettv->vval.v_list, l2) == FAIL
-		|| list_append_number(l2, idx) == FAIL
+	if (list_append_list(rettv->vval.v_list, l2) == FAIL)
+	{
+	    vim_free(l2);
+	    break;
+	}
+	if (list_append_number(l2, idx) == FAIL
 		|| list_append_string(l2, p, len) == FAIL)
 	    break;
 	p += len;
diff --git a/src/search.c b/src/search.c
index 0c2a990caa..8045bd735c 100644
--- a/src/search.c
+++ b/src/search.c
@@ -4748,8 +4748,7 @@ fuzzy_match_in_list(
 		if (items[i].score == SCORE_NONE)
 		    break;
 		if (items[i].lmatchpos != NULL
-			&& list_append_list(retlist, items[i].lmatchpos)
-								== FAIL)
+		      && list_append_list(retlist, items[i].lmatchpos) == FAIL)
 		    goto done;
 	    }
 
@@ -4869,17 +4868,26 @@ do_fuzzymatch(typval_T *argvars, typval_T *rettv, int retmatchpos)
 	if (l == NULL)
 	    goto done;
 	if (list_append_list(rettv->vval.v_list, l) == FAIL)
+	{
+	    vim_free(l);
 	    goto done;
+	}
 	l = list_alloc();
 	if (l == NULL)
 	    goto done;
 	if (list_append_list(rettv->vval.v_list, l) == FAIL)
+	{
+	    vim_free(l);
 	    goto done;
+	}
 	l = list_alloc();
 	if (l == NULL)
 	    goto done;
 	if (list_append_list(rettv->vval.v_list, l) == FAIL)
+	{
+	    vim_free(l);
 	    goto done;
+	}
     }
 
     fuzzy_match_in_list(argvars[0].vval.v_list, tv_get_string(&argvars[1]),
diff --git a/src/version.c b/src/version.c
index 1ff36ffc9b..80914885fe 100644
--- a/src/version.c
+++ b/src/version.c
@@ -708,6 +708,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    338,
+/**/
     337,
 /**/
     336,