From 1ac588543ded834b254c7f6a73372583ce89f2ea Mon Sep 17 00:00:00 2001
From: zeertzjq <zeertzjq@outlook.com>
Date: Sat, 7 Oct 2023 06:32:06 +0800
Subject: [PATCH] vim-patch:9.0.1995: Invalid memory access with empty
 'foldexpr' (#25530)

Problem:  Invalid memory access when 'foldexpr' returns empty string.
Solution: Check for NUL.

closes: vim/vim#13293

https://github.com/vim/vim/commit/a991ce9c083bb8c02b1b1ec34ed35728197050f3
---
 src/nvim/eval.c                | 2 +-
 test/old/testdir/test_fold.vim | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/nvim/eval.c b/src/nvim/eval.c
index 9a90e430a7..12226dac91 100644
--- a/src/nvim/eval.c
+++ b/src/nvim/eval.c
@@ -1299,7 +1299,7 @@ int eval_foldexpr(win_T *wp, int *cp)
       // If the result is a string, check if there is a non-digit before
       // the number.
       char *s = tv.vval.v_string;
-      if (!ascii_isdigit(*s) && *s != '-') {
+      if (*s != NUL && !ascii_isdigit(*s) && *s != '-') {
         *cp = (uint8_t)(*s++);
       }
       retval = atol(s);
diff --git a/test/old/testdir/test_fold.vim b/test/old/testdir/test_fold.vim
index ccd1bfecf8..e529a94174 100644
--- a/test/old/testdir/test_fold.vim
+++ b/test/old/testdir/test_fold.vim
@@ -1569,4 +1569,13 @@ func Test_foldcolumn_linebreak_control_char()
   bwipe!
 endfunc
 
+" This used to cause invalid memory access
+func Test_foldexpr_return_empty_string()
+  new
+  setlocal foldexpr='' foldmethod=expr
+  redraw
+
+  bwipe!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab