thac0/vim
1
0
Fork 0
forked from aniani/vim
Code Activity

patch 8.2.1083: crash when using reduce() on a NULL list

Browse Source 
Problem:    Crash when using reduce() on a NULL list.
Solution:   Only access the list when not NULL.
This commit is contained in:
Bram Moolenaar
2020-06-29 20:09:36 +02:00
parent 91639195ef
commit fda20c4cc5
3 changed files with 23 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
src/list.c
View File

@@ -2475,10 +2475,10 @@ f_reduce(typval_T *argvars, typval_T *rettv)
list_T *l = argvars[0].vval.v_list;
listitem_T *li = NULL;
int r;
int prev_locked = l->lv_lock;
int called_emsg_start = called_emsg;
CHECK_LIST_MATERIALIZE(l);
if (l != NULL)
CHECK_LIST_MATERIALIZE(l);
if (argvars[2].v_type == VAR_UNKNOWN)
{
if (l == NULL || l->lv_first == NULL)
@@ -2495,20 +2495,25 @@ f_reduce(typval_T *argvars, typval_T *rettv)
if (l != NULL)
li = l->lv_first;
}
l->lv_lock = VAR_FIXED; // disallow the list changing here
copy_tv(&initial, rettv);
for ( ; li != NULL; li = li->li_next)
if (l != NULL)
{
argv[0] = *rettv;
argv[1] = li->li_tv;
rettv->v_type = VAR_UNKNOWN;
r = call_func(func_name, -1, rettv, 2, argv, &funcexe);
clear_tv(&argv[0]);
if (r == FAIL || called_emsg != called_emsg_start)
break;
int prev_locked = l->lv_lock;
l->lv_lock = VAR_FIXED; // disallow the list changing here
for ( ; li != NULL; li = li->li_next)
{
argv[0] = *rettv;
argv[1] = li->li_tv;
rettv->v_type = VAR_UNKNOWN;
r = call_func(func_name, -1, rettv, 2, argv, &funcexe);
clear_tv(&argv[0]);
if (r == FAIL || called_emsg != called_emsg_start)
break;
}
l->lv_lock = prev_locked;
}
l->lv_lock = prev_locked;
}
else
{