patch 8.0.0356: leaking memory when setting 'ttytype'

Problem:    Leaking memory when setting 'ttytype'.
Solution:   Get free_oldval from the right option entry.

src/misc1.c

@@ -4028,15 +4028,12 @@ expand_env_esc(
 		 */
 #  if defined(HAVE_GETPWNAM) && defined(HAVE_PWD_H)
 		{
-		    struct passwd *pw;
-
 		    /* Note: memory allocated by getpwnam() is never freed.
 		     * Calling endpwent() apparently doesn't help. */
-		    pw = getpwnam((char *)dst + 1);
+		    struct passwd *pw = (*dst == NUL)
-		    if (pw != NULL)
+					? NULL : getpwnam((char *)dst + 1);
-			var = (char_u *)pw->pw_dir;
+
-		    else
+		    var = (pw == NULL) ? NULL : (char_u *)pw->pw_dir;
-			var = NULL;
 		}
 		if (var == NULL)
 #  endif
@@ -9652,7 +9649,7 @@ expand_wildcards(
 # endif
 	    if (match_file_list(p_wig, (*files)[i], ffname))
 	    {
-		/* remove this matching files from the list */
+		/* remove this matching file from the list */
 		vim_free((*files)[i]);
 		for (j = i; j + 1 < *num_files; ++j)
 		    (*files)[j] = (*files)[j + 1];
@@ -10736,14 +10733,15 @@ has_env_var(char_u *p)
 static int has_special_wildchar(char_u *p);
 
 /*
- * Return TRUE if "p" contains a special wildcard character.
+ * Return TRUE if "p" contains a special wildcard character, one that Vim
- * Allowing for escaping.
+ * cannot expand, requires using a shell.
  */
     static int
 has_special_wildchar(char_u *p)
 {
     for ( ; *p; mb_ptr_adv(p))
     {
+	/* Allow for escaping. */
 	if (*p == '\\' && p[1] != NUL)
 	    ++p;
 	else if (vim_strchr((char_u *)SPECIAL_WILDCHAR, *p) != NULL)

src/option.c

@@ -5936,6 +5936,7 @@ did_set_string_option(
 	    /* Both 'term' and 'ttytype' point to T_NAME, only set the
 	     * P_ALLOCED flag on 'term'. */
 	    opt_idx = findoption((char_u *)"term");
+	    free_oldval = (options[opt_idx].flags & P_ALLOCED);
 	}
     }
 

src/screen.c

@@ -6730,7 +6730,7 @@ win_redr_status(win_T *wp)
 	if (wp->w_buffer->b_p_ro)
 	{
 	    STRCPY(p + len, _("[RO]"));
-	    len += 4;
+	    len += (int)STRLEN(p + len);
 	}
 
 	this_ru_col = ru_col - (Columns - W_WIDTH(wp));

src/testdir/test_assign.vim

@@ -15,7 +15,7 @@ func Test_let_termcap()
   call assert_match('t_te.*^[[yes;', execute("set termcap"))
   let &t_te = old_t_te
 
-  if !has('gui_running')
+  if exists("+t_k1")
     " Key code
     let old_t_k1 = &t_k1
     let &t_k1 = "that"

src/testdir/test_options.vim

@@ -22,6 +22,13 @@ function! Test_whichwrap()
   set whichwrap&
 endfunction
 
+function! Test_isfname()
+  " This used to cause Vim to access uninitialized memory.
+  set isfname=
+  call assert_equal("~X", expand("~X"))
+  set isfname&
+endfunction
+
 function Test_options()
   let caught = 'ok'
   try

src/version.c

@@ -764,6 +764,14 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    356,
+/**/
+    355,
+/**/
+    354,
+/**/
+    353,
 /**/
     352,
 /**/