From 0ea21e41c6789c356762f970ecf168a897dcf8b6 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Tue, 12 Feb 2019 20:46:48 +0100
Subject: patch 8.1.0898: a messed up rgb.txt can crash Vim

Problem:    A messed up rgb.txt can crash Vim. (Pavel Cheremushkin)
Solution:   Limit to 10000 entries.  Also don't retry many times when the file
            cannot be read.
---
 src/term.c    | 10 ++++++++--
 src/version.c |  2 ++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/term.c b/src/term.c
index 47d2bdafb1..be33fb92d5 100644
--- a/src/term.c
+++ b/src/term.c
@@ -6985,13 +6985,13 @@ gui_get_color_cmn(char_u *name)
 	    return rgb_table[i].color;
 
     /*
-     * Last attempt. Look in the file "$VIM/rgb.txt".
+     * Last attempt. Look in the file "$VIMRUNTIME/rgb.txt".
      */
     if (size == 0)
     {
 	int counting;
 
-	/* colornames_table not yet initialized */
+	// colornames_table not yet initialized
 	fname = expand_env_save((char_u *)"$VIMRUNTIME/rgb.txt");
 	if (fname == NULL)
 	    return INVALCOLOR;
@@ -7002,6 +7002,7 @@ gui_get_color_cmn(char_u *name)
 	{
 	    if (p_verbose > 1)
 		verb_msg(_("Cannot open $VIMRUNTIME/rgb.txt"));
+	    size = -1;  // don't try again
 	    return INVALCOLOR;
 	}
 
@@ -7050,6 +7051,11 @@ gui_get_color_cmn(char_u *name)
 		    colornames_table[size].color = (guicolor_T)RGB(r, g, b);
 		}
 		size++;
+
+		// The distributed rgb.txt has less than 1000 entries. Limit to
+		// 10000, just in case the file was messed up.
+		if (size == 10000)
+		    break;
 	    }
 	}
 	fclose(fd);
diff --git a/src/version.c b/src/version.c
index 6e3d7806fb..a2c250e529 100644
--- a/src/version.c
+++ b/src/version.c
@@ -783,6 +783,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    898,
 /**/
     897,
 /**/
-- 
cgit v1.2.3