updated for version 7.4.063

Problem:    Crash when using invalid key in Python dictionary.
Solution:   Check for object to be NULL.  Add tests. (ZyX)

6 files changed, 17 insertions, 0 deletions

diff --git a/src/if_py_both.h b/src/if_py_both.h
index 6ea0afff6..748577981 100644
--- a/src/if_py_both.h
+++ b/src/if_py_both.h
@@ -1624,6 +1624,9 @@ DictionaryContains(DictionaryObject *self, PyObject *keyObject)
     PyObject	*rObj = _DictionaryItem(self, keyObject, DICT_FLAG_RETURN_BOOL);
     int		ret;
 
+    if (rObj == NULL)
+	return -1;
+
     ret = (rObj == Py_True);
 
     Py_DECREF(rObj);
diff --git a/src/testdir/test86.in b/src/testdir/test86.in
index ba3557be3..48fa4e5a1 100644
--- a/src/testdir/test86.in
+++ b/src/testdir/test86.in
@@ -1088,6 +1088,9 @@ ee('d.get("a", 2, 3)')
 stringtochars_test('d.get(%s)')
 ee('d.pop("a")')
 ee('dl.pop("a")')
+cb.append(">> DictionaryContains")
+ee('"" in d')
+ee('0 in d')
 cb.append(">> DictionaryIterNext")
 ee('for i in ned: ned["a"] = 1')
 del i
diff --git a/src/testdir/test86.ok b/src/testdir/test86.ok
index c8517b3dc..69c98d02d 100644
--- a/src/testdir/test86.ok
+++ b/src/testdir/test86.ok
@@ -516,6 +516,9 @@ d.get("\0"):TypeError:('expected string without null bytes',)
 <<< Finished
 d.pop("a"):KeyError:('a',)
 dl.pop("a"):error:('dictionary is locked',)
+>> DictionaryContains
+"" in d:ValueError:('empty keys are not allowed',)
+0 in d:TypeError:('expected str() or unicode() instance, but got int',)
 >> DictionaryIterNext
 for i in ned: ned["a"] = 1:RuntimeError:('hashtab changed during iteration',)
 >> DictionaryAssItem
diff --git a/src/testdir/test87.in b/src/testdir/test87.in
index 0ee6df3b2..54cd97748 100644
--- a/src/testdir/test87.in
+++ b/src/testdir/test87.in
@@ -1039,6 +1039,9 @@ ee('d.get("a", 2, 3)')
 stringtochars_test('d.get(%s)')
 ee('d.pop("a")')
 ee('dl.pop("a")')
+cb.append(">> DictionaryContains")
+ee('"" in d')
+ee('0 in d')
 cb.append(">> DictionaryIterNext")
 ee('for i in ned: ned["a"] = 1')
 del i
diff --git a/src/testdir/test87.ok b/src/testdir/test87.ok
index 9a2d686cd..eed179c5a 100644
--- a/src/testdir/test87.ok
+++ b/src/testdir/test87.ok
@@ -505,6 +505,9 @@ d.get("\0"):(<class 'TypeError'>, TypeError('expected bytes with no null',))
 <<< Finished
 d.pop("a"):(<class 'KeyError'>, KeyError('a',))
 dl.pop("a"):(<class 'vim.error'>, error('dictionary is locked',))
+>> DictionaryContains
+"" in d:(<class 'ValueError'>, ValueError('empty keys are not allowed',))
+0 in d:(<class 'TypeError'>, TypeError('expected bytes() or str() instance, but got int',))
 >> DictionaryIterNext
 for i in ned: ned["a"] = 1:(<class 'RuntimeError'>, RuntimeError('hashtab changed during iteration',))
 >> DictionaryAssItem
diff --git a/src/version.c b/src/version.c
index 229672a30..b46d791b4 100644
--- a/src/version.c
+++ b/src/version.c
@@ -739,6 +739,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    63,
+/**/
     62,
 /**/
     61,