vim-patch:8.1.2282: crash when passing many arguments through a partial

Problem:    Crash when passing many arguments through a partial. (Andy
            Massimino)
Solution:   Check the number of arguments. (closes vim/vim#5186)
https://github.com/vim/vim/commit/4c054e9fb23027b55a09ee647a3a2c91936aeb1b

1 files changed, 11 insertions, 4 deletions

diff --git a/src/nvim/eval.c b/src/nvim/eval.c
index 7c7e9da8ac..f301d29335 100644
--- a/src/nvim/eval.c
+++ b/src/nvim/eval.c
@@ -6328,6 +6328,10 @@ call_func(
     }
     if (error == ERROR_NONE && partial->pt_argc > 0) {
       for (argv_clear = 0; argv_clear < partial->pt_argc; argv_clear++) {
+        if (argv_clear + argcount_in >= MAX_FUNC_ARGS) {
+          error = ERROR_TOOMANY;
+          goto theend;
+        }
         tv_copy(&partial->pt_argv[argv_clear], &argv[argv_clear]);
       }
       for (int i = 0; i < argcount_in; i++) {
@@ -6432,10 +6436,9 @@ call_func(
   if (error == ERROR_NONE)
     ret = OK;
 
-  /*
-   * Report an error unless the argument evaluation or function call has been
-   * cancelled due to an aborting error, an interrupt, or an exception.
-   */
+theend:
+  // Report an error unless the argument evaluation or function call has been
+  // cancelled due to an aborting error, an interrupt, or an exception.
   if (!aborting()) {
     switch (error) {
     case ERROR_UNKNOWN:
@@ -7132,6 +7135,10 @@ void common_function(typval_T *argvars, typval_T *rettv,
         list = argvars[arg_idx].vval.v_list;
         if (tv_list_len(list) == 0) {
           arg_idx = 0;
+        } else if (tv_list_len(list) > MAX_FUNC_ARGS) {
+          emsg_funcname((char *)e_toomanyarg, name);
+          xfree(name);
+          goto theend;
         }
       }
     }