aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-09-25 03:54:15 -04:00
Code Activity

patch 9.0.1322: crash when indexing "any" which is an object

Browse Source 
Problem:    Crash when indexing "any" which is an object.
Solution:   Check the index is a number.  Do not check the member type of an
            object.  (closes #12019)
This commit is contained in:
Bram Moolenaar
2023-02-18 18:38:37 +00:00
parent d114975b9b
commit 2c1c803c7e
4 changed files with 104 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/vim9compile.c
View File

@@ -2011,13 +2011,13 @@ compile_load_lhs(
size_t varlen = lhs->lhs_varlen;
int c = var_start[varlen];
int lines_len = cctx->ctx_ufunc->uf_lines.ga_len;
char_u *p = var_start;
int res;
// Evaluate "ll[expr]" of "ll[expr][idx]". End the line with a NUL and
// limit the lines array length to avoid skipping to a following line.
var_start[varlen] = NUL;
cctx->ctx_ufunc->uf_lines.ga_len = cctx->ctx_lnum + 1;
char_u *p = var_start;
res = compile_expr0(&p, cctx);
var_start[varlen] = c;
cctx->ctx_ufunc->uf_lines.ga_len = lines_len;
@@ -2031,10 +2031,15 @@ compile_load_lhs(
lhs->lhs_type = cctx->ctx_type_stack.ga_len == 0 ? &t_void
: get_type_on_stack(cctx, 0);
// now we can properly check the type
if (rhs_type != NULL && lhs->lhs_type->tt_member != NULL
// Now we can properly check the type. The variable is indexed, thus
// we need the member type. For a class or object we don't know the
// type yet, it depends on what member is used.
vartype_T vartype = lhs->lhs_type->tt_type;
type_T *member_type = lhs->lhs_type->tt_member;
if (rhs_type != NULL && member_type != NULL
&& vartype != VAR_OBJECT && vartype != VAR_CLASS
&& rhs_type != &t_void
&& need_type(rhs_type, lhs->lhs_type->tt_member, FALSE,
&& need_type(rhs_type, member_type, FALSE,
-2, 0, cctx, FALSE, FALSE) == FAIL)
return FAIL;
}