From 9c2b06637b32742cac11bfd66b1a4e84583c6c2e Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Tue, 1 Sep 2020 19:56:15 +0200
Subject: patch 8.2.1560: using NULL pointers in some code

Problem:    Using NULL pointers in some code. (James McCoy)
Solution:   Avoid adding to a NULL pointer.  Use byte as unsigned.
---
 src/eval.c         |  2 +-
 src/fold.c         | 22 ++++++++++++----------
 src/spellfile.c    |  2 +-
 src/spellsuggest.c |  2 ++
 src/version.c      |  2 ++
 src/vim9compile.c  | 10 ++++++++--
 6 files changed, 26 insertions(+), 14 deletions(-)

diff --git a/src/eval.c b/src/eval.c
index be3f4622cb..3eb4be46f0 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -395,7 +395,7 @@ skip_expr_concatenate(
     typval_T	rettv;
     int		res;
     int		vim9script = in_vim9script();
-    garray_T    *gap = &evalarg->eval_ga;
+    garray_T    *gap = evalarg == NULL ? NULL : &evalarg->eval_ga;
     int		save_flags = evalarg == NULL ? 0 : evalarg->eval_flags;
     int		evaluate = evalarg == NULL
 			       ? FALSE : (evalarg->eval_flags & EVAL_EVALUATE);
diff --git a/src/fold.c b/src/fold.c
index 3c106d25cf..d95b46b5b4 100644
--- a/src/fold.c
+++ b/src/fold.c
@@ -1314,7 +1314,7 @@ setManualFoldWin(
 	if (!foldFind(gap, lnum, &fp))
 	{
 	    // If there is a following fold, continue there next time.
-	    if (fp < (fold_T *)gap->ga_data + gap->ga_len)
+	    if (fp != NULL && fp < (fold_T *)gap->ga_data + gap->ga_len)
 		next = fp->fd_top + off;
 	    break;
 	}
@@ -2905,18 +2905,20 @@ foldSplit(
     // any between top and bot, they have been removed by the caller.
     gap1 = &fp->fd_nested;
     gap2 = &fp[1].fd_nested;
-    (void)(foldFind(gap1, bot + 1 - fp->fd_top, &fp2));
-    len = (int)((fold_T *)gap1->ga_data + gap1->ga_len - fp2);
-    if (len > 0 && ga_grow(gap2, len) == OK)
+    if (foldFind(gap1, bot + 1 - fp->fd_top, &fp2))
     {
-	for (idx = 0; idx < len; ++idx)
+	len = (int)((fold_T *)gap1->ga_data + gap1->ga_len - fp2);
+	if (len > 0 && ga_grow(gap2, len) == OK)
 	{
-	    ((fold_T *)gap2->ga_data)[idx] = fp2[idx];
-	    ((fold_T *)gap2->ga_data)[idx].fd_top
-						 -= fp[1].fd_top - fp->fd_top;
+	    for (idx = 0; idx < len; ++idx)
+	    {
+		((fold_T *)gap2->ga_data)[idx] = fp2[idx];
+		((fold_T *)gap2->ga_data)[idx].fd_top
+						  -= fp[1].fd_top - fp->fd_top;
+	    }
+	    gap2->ga_len = len;
+	    gap1->ga_len -= len;
 	}
-	gap2->ga_len = len;
-	gap1->ga_len -= len;
     }
     fp->fd_len = top - fp->fd_top;
     fold_changed = TRUE;
diff --git a/src/spellfile.c b/src/spellfile.c
index 6aeac86b85..d5ec3feadd 100644
--- a/src/spellfile.c
+++ b/src/spellfile.c
@@ -816,7 +816,7 @@ read_cnt_string(FILE *fd, int cnt_bytes, int *cntp)
 
     // read the length bytes, MSB first
     for (i = 0; i < cnt_bytes; ++i)
-	cnt = (cnt << 8) + getc(fd);
+	cnt = (cnt << 8) + (unsigned)getc(fd);
     if (cnt < 0)
     {
 	*cntp = SP_TRUNCERROR;
diff --git a/src/spellsuggest.c b/src/spellsuggest.c
index 0821dc62cb..96e7bb634c 100644
--- a/src/spellsuggest.c
+++ b/src/spellsuggest.c
@@ -3606,6 +3606,8 @@ check_suggestions(
     int		len;
     hlf_T	attr;
 
+    if (gap->ga_len == 0)
+	return;
     stp = &SUG(*gap, 0);
     for (i = gap->ga_len - 1; i >= 0; --i)
     {
diff --git a/src/version.c b/src/version.c
index 158f2a3472..29f4363415 100644
--- a/src/version.c
+++ b/src/version.c
@@ -754,6 +754,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1560,
 /**/
     1559,
 /**/
diff --git a/src/vim9compile.c b/src/vim9compile.c
index 0c9f56f5a0..5893e5ac0b 100644
--- a/src/vim9compile.c
+++ b/src/vim9compile.c
@@ -1147,7 +1147,10 @@ generate_NEWLIST(cctx_T *cctx, int count)
     isn->isn_arg.number = count;
 
     // get the member type from all the items on the stack.
-    member = get_member_type_from_stack(
+    if (count == 0)
+	member = &t_void;
+    else
+	member = get_member_type_from_stack(
 	    ((type_T **)stack->ga_data) + stack->ga_len, count, 1,
 							  cctx->ctx_type_list);
     type = get_list_type(member, cctx->ctx_type_list);
@@ -1180,7 +1183,10 @@ generate_NEWDICT(cctx_T *cctx, int count)
 	return FAIL;
     isn->isn_arg.number = count;
 
-    member = get_member_type_from_stack(
+    if (count == 0)
+	member = &t_void;
+    else
+	member = get_member_type_from_stack(
 	    ((type_T **)stack->ga_data) + stack->ga_len, count, 2,
 							  cctx->ctx_type_list);
     type = get_dict_type(member, cctx->ctx_type_list);
-- 
cgit v1.2.3