mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-09-14 23:38:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.1.2282: crash when passing many arguments through a partial

Browse Source 
Problem:    Crash when passing many arguments through a partial. (Andy
            Massimino)
Solution:   Check the number of arguments. (closes vim/vim#5186)
4c054e9fb2
This commit is contained in:
Jan Edmund Lazo
2020-03-18 01:15:27 -04:00
parent dbb386e1b2
commit 16a4581349
4 changed files with 34 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
src/nvim/eval.c
View File

@@ -6328,6 +6328,10 @@ call_func(
}
if (error == ERROR_NONE && partial->pt_argc > 0) {
for (argv_clear = 0; argv_clear < partial->pt_argc; argv_clear++) {
if (argv_clear + argcount_in >= MAX_FUNC_ARGS) {
error = ERROR_TOOMANY;
goto theend;
}
tv_copy(&partial->pt_argv[argv_clear], &argv[argv_clear]);
}
for (int i = 0; i < argcount_in; i++) {
@@ -6432,10 +6436,9 @@ call_func(
if (error == ERROR_NONE)
ret = OK;
/*
* Report an error unless the argument evaluation or function call has been
* cancelled due to an aborting error, an interrupt, or an exception.
*/
theend:
// Report an error unless the argument evaluation or function call has been
// cancelled due to an aborting error, an interrupt, or an exception.
if (!aborting()) {
switch (error) {
case ERROR_UNKNOWN:
@@ -7132,6 +7135,10 @@ void common_function(typval_T *argvars, typval_T *rettv,
list = argvars[arg_idx].vval.v_list;
if (tv_list_len(list) == 0) {
arg_idx = 0;
} else if (tv_list_len(list) > MAX_FUNC_ARGS) {
emsg_funcname((char *)e_toomanyarg, name);
xfree(name);
goto theend;
}
}
}