patch 9.1.1406: crash when importing invalid tuple

Problem:  crash when importing invalid tuple
          (Yang LUO, Yanju Chen)
Solution: set type to VAR_UNKNOWN, so that it isn't freed
          (Yegappan Lakshmanan)

closes: #17362

Signed-off-by: Yegappan Lakshmanan <yegappan@yahoo.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/testdir/test_tuple.vim b/src/testdir/test_tuple.vim
index e767851af2d1386e37c1719d3e116027695c5e78..45f730d86bf110f8fae77bdc7672aa7f7d168398 100644 (file)
--- a/src/testdir/test_tuple.vim
+++ b/src/testdir/test_tuple.vim
@@ -1586,6 +1586,17 @@ func Test_recursive_tuple_eval_fails()
         \ 'E121: Undefined variable: pat'])
 endfunc
 
+" The following used to crash Vim
+func Test_import_invalid_tuple()
+  let lines =<< trim END
+    imp(",G0}11*f\1d[+\x","#|
+  END
+  new
+  call setline(1, lines)
+  call assert_fails('source', 'E114: Missing double quote: "#|')
+  bw!
+endfunc
+
 " Test for add() with a tuple
 func Test_tuple_add()
   let lines =<< trim END

diff --git a/src/tuple.c b/src/tuple.c
index eff4bdccc44ed5d9c18336deae546fa0e867193a..9ca1f34092d693a8e4f1a55cae4e17f89785afe3 100644 (file)
--- a/src/tuple.c
+++ b/src/tuple.c
@@ -518,6 +518,9 @@ eval_tuple(char_u **arg, typval_T *rettv, evalarg_T *evalarg, int do_error)
            // Add the first item to the tuple from "rettv"
            if (tuple_append_tv(tuple, rettv) == FAIL)
                return FAIL;
+           // The first item in "rettv" is added to the tuple.  Set the rettv
+           // type to unknown, so that the caller doesn't free it.
+           rettv->v_type = VAR_UNKNOWN;
        }
     }
 

diff --git a/src/version.c b/src/version.c
index c45c65e7b7c26d54bdce0217313e249d77209721..b9af08a7dee23343414aef877f6cd34015942bf2 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -709,6 +709,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1406,
 /**/
     1405,
 /**/