From 16a4581349f45f4030a4a361228bc1d69fb7e45f Mon Sep 17 00:00:00 2001 From: Jan Edmund Lazo Date: Wed, 18 Mar 2020 01:15:27 -0400 Subject: vim-patch:8.1.2282: crash when passing many arguments through a partial Problem: Crash when passing many arguments through a partial. (Andy Massimino) Solution: Check the number of arguments. (closes vim/vim#5186) https://github.com/vim/vim/commit/4c054e9fb23027b55a09ee647a3a2c91936aeb1b --- src/nvim/eval.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) (limited to 'src/nvim/eval.c') diff --git a/src/nvim/eval.c b/src/nvim/eval.c index 7c7e9da8ac..f301d29335 100644 --- a/src/nvim/eval.c +++ b/src/nvim/eval.c @@ -6328,6 +6328,10 @@ call_func( } if (error == ERROR_NONE && partial->pt_argc > 0) { for (argv_clear = 0; argv_clear < partial->pt_argc; argv_clear++) { + if (argv_clear + argcount_in >= MAX_FUNC_ARGS) { + error = ERROR_TOOMANY; + goto theend; + } tv_copy(&partial->pt_argv[argv_clear], &argv[argv_clear]); } for (int i = 0; i < argcount_in; i++) { @@ -6432,10 +6436,9 @@ call_func( if (error == ERROR_NONE) ret = OK; - /* - * Report an error unless the argument evaluation or function call has been - * cancelled due to an aborting error, an interrupt, or an exception. - */ +theend: + // Report an error unless the argument evaluation or function call has been + // cancelled due to an aborting error, an interrupt, or an exception. if (!aborting()) { switch (error) { case ERROR_UNKNOWN: @@ -7132,6 +7135,10 @@ void common_function(typval_T *argvars, typval_T *rettv, list = argvars[arg_idx].vval.v_list; if (tv_list_len(list) == 0) { arg_idx = 0; + } else if (tv_list_len(list) > MAX_FUNC_ARGS) { + emsg_funcname((char *)e_toomanyarg, name); + xfree(name); + goto theend; } } } -- cgit