# HG changeset patch
# User Christian Brabandt <cb@256bit.org>
# Date 1454540405 -3600
# Node ID ce5a7a61386772904fc253d4b65a07b6ff75b2bd
# Parent  23397b25221e6d950ab9d7e6c1fd8b78fa81f706
commit https://github.com/vim/vim/commit/66624ff0d9e1de2fc5eb4f95f3a3a2ed70b10138
Author: Bram Moolenaar <Bram@vim.org>
Date:   Wed Feb 3 23:59:43 2016 +0100

    patch 7.4.1255
    Problem:    Crash for channel "eval" command without third argument.
    Solution:   Check for missing argument.

diff --git a/src/channel.c b/src/channel.c
--- a/src/channel.c
+++ b/src/channel.c
@@ -694,7 +694,7 @@ channel_exe_cmd(int idx, char_u *cmd, ty
     {
 	int is_eval = cmd[1] == 'v';
 
-	if (is_eval && arg3->v_type != VAR_NUMBER)
+	if (is_eval && (arg3 == NULL || arg3->v_type != VAR_NUMBER))
 	{
 	    if (p_verbose > 2)
 		EMSG("E904: third argument for eval must be a number");
@@ -774,7 +774,7 @@ may_invoke_callback(int idx)
 	    typval_T	*arg3 = NULL;
 	    char_u	*cmd = typetv->vval.v_string;
 
-	    /* ["cmd", arg] */
+	    /* ["cmd", arg] or ["cmd", arg, arg] */
 	    if (list->lv_len == 3)
 		arg3 = &list->lv_last->li_tv;
 	    channel_exe_cmd(idx, cmd, &argv[1], arg3);
diff --git a/src/testdir/test_channel.py b/src/testdir/test_channel.py
--- a/src/testdir/test_channel.py
+++ b/src/testdir/test_channel.py
@@ -68,8 +68,8 @@ class ThreadedTCPRequestHandler(socketse
                         # simply send back a string
                         response = "got it"
                     elif decoded[1] == 'make change':
-                        # Send two ex commands at the same time, before replying to
-                        # the request.
+                        # Send two ex commands at the same time, before
+                        # replying to the request.
                         cmd = '["ex","call append(\\"$\\",\\"added1\\")"]'
                         cmd += '["ex","call append(\\"$\\",\\"added2\\")"]'
                         print("sending: {}".format(cmd))
@@ -87,6 +87,12 @@ class ThreadedTCPRequestHandler(socketse
                         print("sending: {}".format(cmd))
                         self.request.sendall(cmd.encode('utf-8'))
                         response = "ok"
+                    elif decoded[1] == 'eval-bad':
+                        # Send an eval request missing the third argument.
+                        cmd = '["eval","xxx"]'
+                        print("sending: {}".format(cmd))
+                        self.request.sendall(cmd.encode('utf-8'))
+                        response = "ok"
                     elif decoded[1] == 'eval-result':
                         # Send back the last received eval result.
                         response = last_eval
diff --git a/src/testdir/test_channel.vim b/src/testdir/test_channel.vim
--- a/src/testdir/test_channel.vim
+++ b/src/testdir/test_channel.vim
@@ -90,6 +90,10 @@ func Test_communicate()
   call assert_equal('ok', ch_sendexpr(handle, 'eval-fails'))
   call assert_equal([-2, 'ERROR'], ch_sendexpr(handle, 'eval-result'))
 
+  " Send a bad eval request. There will be no response.
+  call assert_equal('ok', ch_sendexpr(handle, 'eval-bad'))
+  call assert_equal([-2, 'ERROR'], ch_sendexpr(handle, 'eval-result'))
+
   " make the server quit, can't check if this works, should not hang.
   call ch_sendexpr(handle, '!quit!', 0)
 
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -743,6 +743,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1255,
+/**/
     1254,
 /**/
     1253,