patch 7.4.1255

Problem:    Crash for channel "eval" command without third argument.
Solution:   Check for missing argument.

src/channel.c

@@ -694,7 +694,7 @@ channel_exe_cmd(int idx, char_u *cmd, typval_T *arg2, typval_T *arg3)
     {
 	int is_eval = cmd[1] == 'v';
 
-	if (is_eval && arg3->v_type != VAR_NUMBER)
+	if (is_eval && (arg3 == NULL || arg3->v_type != VAR_NUMBER))
 	{
 	    if (p_verbose > 2)
 		EMSG("E904: third argument for eval must be a number");
@@ -774,7 +774,7 @@ may_invoke_callback(int idx)
 	    typval_T	*arg3 = NULL;
 	    char_u	*cmd = typetv->vval.v_string;
 
-	    /* ["cmd", arg] */
+	    /* ["cmd", arg] or ["cmd", arg, arg] */
 	    if (list->lv_len == 3)
 		arg3 = &list->lv_last->li_tv;
 	    channel_exe_cmd(idx, cmd, &argv[1], arg3);

src/testdir/test_channel.py

@@ -68,8 +68,8 @@ class ThreadedTCPRequestHandler(socketserver.BaseRequestHandler):
                         # simply send back a string
                         response = "got it"
                     elif decoded[1] == 'make change':
-                        # Send two ex commands at the same time, before replying to
-                        # the request.
+                        # Send two ex commands at the same time, before
+                        # replying to the request.
                         cmd = '["ex","call append(\\"$\\",\\"added1\\")"]'
                         cmd += '["ex","call append(\\"$\\",\\"added2\\")"]'
                         print("sending: {}".format(cmd))
@@ -87,6 +87,12 @@ class ThreadedTCPRequestHandler(socketserver.BaseRequestHandler):
                         print("sending: {}".format(cmd))
                         self.request.sendall(cmd.encode('utf-8'))
                         response = "ok"
+                    elif decoded[1] == 'eval-bad':
+                        # Send an eval request missing the third argument.
+                        cmd = '["eval","xxx"]'
+                        print("sending: {}".format(cmd))
+                        self.request.sendall(cmd.encode('utf-8'))
+                        response = "ok"
                     elif decoded[1] == 'eval-result':
                         # Send back the last received eval result.
                         response = last_eval

src/testdir/test_channel.vim

@@ -90,6 +90,10 @@ func Test_communicate()
   call assert_equal('ok', ch_sendexpr(handle, 'eval-fails'))
   call assert_equal([-2, 'ERROR'], ch_sendexpr(handle, 'eval-result'))
 
+  " Send a bad eval request. There will be no response.
+  call assert_equal('ok', ch_sendexpr(handle, 'eval-bad'))
+  call assert_equal([-2, 'ERROR'], ch_sendexpr(handle, 'eval-result'))
+
   " make the server quit, can't check if this works, should not hang.
   call ch_sendexpr(handle, '!quit!', 0)
 

src/version.c

@@ -742,6 +742,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1255,
 /**/
     1254,
 /**/