vim-patch:8.1.2282: crash when passing many arguments through a partial

Problem:    Crash when passing many arguments through a partial. (Andy
            Massimino)
Solution:   Check the number of arguments. (closes vim/vim#5186)
https://github.com/vim/vim/commit/4c054e9fb23027b55a09ee647a3a2c91936aeb1b

4 files changed, 34 insertions, 9 deletions

diff --git a/src/nvim/eval.c b/src/nvim/eval.c
index 7c7e9da8ac..f301d29335 100644
--- a/src/nvim/eval.c
+++ b/src/nvim/eval.c
@@ -6328,6 +6328,10 @@ call_func(
     }
     if (error == ERROR_NONE && partial->pt_argc > 0) {
       for (argv_clear = 0; argv_clear < partial->pt_argc; argv_clear++) {
+        if (argv_clear + argcount_in >= MAX_FUNC_ARGS) {
+          error = ERROR_TOOMANY;
+          goto theend;
+        }
         tv_copy(&partial->pt_argv[argv_clear], &argv[argv_clear]);
       }
       for (int i = 0; i < argcount_in; i++) {
@@ -6432,10 +6436,9 @@ call_func(
   if (error == ERROR_NONE)
     ret = OK;
 
-  /*
-   * Report an error unless the argument evaluation or function call has been
-   * cancelled due to an aborting error, an interrupt, or an exception.
-   */
+theend:
+  // Report an error unless the argument evaluation or function call has been
+  // cancelled due to an aborting error, an interrupt, or an exception.
   if (!aborting()) {
     switch (error) {
     case ERROR_UNKNOWN:
@@ -7132,6 +7135,10 @@ void common_function(typval_T *argvars, typval_T *rettv,
         list = argvars[arg_idx].vval.v_list;
         if (tv_list_len(list) == 0) {
           arg_idx = 0;
+        } else if (tv_list_len(list) > MAX_FUNC_ARGS) {
+          emsg_funcname((char *)e_toomanyarg, name);
+          xfree(name);
+          goto theend;
         }
       }
     }
diff --git a/src/nvim/regexp.c b/src/nvim/regexp.c
index dba7c53c10..5ad7ce9a16 100644
--- a/src/nvim/regexp.c
+++ b/src/nvim/regexp.c
@@ -6683,10 +6683,15 @@ static int vim_regsub_both(char_u *source, typval_T *expr, char_u *dest,
           // fill_submatch_list() was called.
           clear_submatch_list(&matchList);
         }
-        char buf[NUMBUFLEN];
-        eval_result = (char_u *)tv_get_string_buf_chk(&rettv, buf);
-        if (eval_result != NULL) {
-          eval_result = vim_strsave(eval_result);
+        if (rettv.v_type == VAR_UNKNOWN) {
+          // something failed, no need to report another error
+          eval_result = NULL;
+        } else {
+          char buf[NUMBUFLEN];
+          eval_result = (char_u *)tv_get_string_buf_chk(&rettv, buf);
+          if (eval_result != NULL) {
+            eval_result = vim_strsave(eval_result);
+          }
         }
         tv_clear(&rettv);
       } else {
diff --git a/src/nvim/testdir/test_expr.vim b/src/nvim/testdir/test_expr.vim
index dd546dbf71..264d8b000f 100644
--- a/src/nvim/testdir/test_expr.vim
+++ b/src/nvim/testdir/test_expr.vim
@@ -475,6 +475,8 @@ func Test_funcref()
   let OneByRef = funcref('One')
   call assert_equal(2, OneByRef())
   call assert_fails('echo funcref("{")', 'E475:')
+  let OneByRef = funcref("One", repeat(["foo"], 20))
+  call assert_fails('let OneByRef = funcref("One", repeat(["foo"], 21))', 'E118:')
 endfunc
 
 func Test_empty_concatenate()
diff --git a/src/nvim/testdir/test_substitute.vim b/src/nvim/testdir/test_substitute.vim
index 25a8676b0c..ff07d8eceb 100644
--- a/src/nvim/testdir/test_substitute.vim
+++ b/src/nvim/testdir/test_substitute.vim
@@ -616,9 +616,20 @@ endfunc
 func SubReplacer(text, submatches)
   return a:text .. a:submatches[0] .. a:text
 endfunc
+func SubReplacer20(t1, t2, t3, t4, t5, t6, t7, t8, t9, t10, t11, t12, t13, t14, t15, t16, t17, t18, t19, submatches)
+  return a:t3 .. a:submatches[0] .. a:t11
+endfunc
 
 func Test_substitute_partial()
-   call assert_equal('1foo2foo3', substitute('123', '2', function('SubReplacer', ['foo']), 'g'))
+  call assert_equal('1foo2foo3', substitute('123', '2', function('SubReplacer', ['foo']), 'g'))
+
+  " 19 arguments plus one is just OK
+  let Replacer = function('SubReplacer20', repeat(['foo'], 19))
+  call assert_equal('1foo2foo3', substitute('123', '2', Replacer, 'g'))
+
+  " 20 arguments plus one is too many
+  let Replacer = function('SubReplacer20', repeat(['foo'], 20))
+  call assert_fails("call substitute('123', '2', Replacer, 'g')", 'E118')
 endfunc
 
 func Test_sub_cmd_9()