aniani/vim
0
0
Fork 1
mirror of https://github.com/vim/vim.git synced 2025-10-31 09:57:14 -04:00
Code Activity

patch 8.2.1083: crash when using reduce() on a NULL list

Browse Source 
Problem:    Crash when using reduce() on a NULL list.
Solution:   Only access the list when not NULL.
This commit is contained in:
Bram Moolenaar
2020-06-29 20:09:36 +02:00
parent 91639195ef
commit fda20c4cc5
3 changed files with 23 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/list.c
View File

@@ -2475,9 +2475,9 @@ f_reduce(typval_T *argvars, typval_T *rettv)
list_T *l = argvars[0].vval.v_list; list_T *l = argvars[0].vval.v_list;
listitem_T *li = NULL; listitem_T *li = NULL;
int r; int r;
int prev_locked = l->lv_lock;
int called_emsg_start = called_emsg; int called_emsg_start = called_emsg;
if (l != NULL)
CHECK_LIST_MATERIALIZE(l); CHECK_LIST_MATERIALIZE(l);
if (argvars[2].v_type == VAR_UNKNOWN) if (argvars[2].v_type == VAR_UNKNOWN)
{ {
@@ -2495,9 +2495,13 @@ f_reduce(typval_T *argvars, typval_T *rettv)
if (l != NULL) if (l != NULL)
li = l->lv_first; li = l->lv_first;
} }
copy_tv(&initial, rettv);
if (l != NULL)
{
int prev_locked = l->lv_lock;
l->lv_lock = VAR_FIXED; // disallow the list changing here l->lv_lock = VAR_FIXED; // disallow the list changing here
copy_tv(&initial, rettv);
for ( ; li != NULL; li = li->li_next) for ( ; li != NULL; li = li->li_next)
{ {
argv[0] = *rettv; argv[0] = *rettv;
@@ -2510,6 +2514,7 @@ f_reduce(typval_T *argvars, typval_T *rettv)
} }
l->lv_lock = prev_locked; l->lv_lock = prev_locked;
} }
}
else else
{ {
blob_T *b = argvars[0].vval.v_blob; blob_T *b = argvars[0].vval.v_blob;

3
src/testdir/test_listdict.vim
View File

@@ -718,6 +718,9 @@ func Test_reduce()
call assert_fails("call reduce(g:lut, { acc, val -> EvilRemove() }, 1)", 'E742:') call assert_fails("call reduce(g:lut, { acc, val -> EvilRemove() }, 1)", 'E742:')
unlet g:lut unlet g:lut
delfunc EvilRemove delfunc EvilRemove
call assert_equal(42, reduce(test_null_list(), function('add'), 42))
call assert_equal(42, reduce(test_null_blob(), function('add'), 42))
endfunc endfunc
" splitting a string to a List using split() " splitting a string to a List using split()

2
src/version.c
View File

@@ -754,6 +754,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
1083,
/**/ /**/
1082, 1082,
/**/ /**/