changeset 20685:4c66962d322b v8.2.0896

patch 8.2.0896: crash when calling searchcount() with a string Commit: https://github.com/vim/vim/commit/14681627f39421cce289345d4ec9927c10fa3b1c Author: Bram Moolenaar <Bram@vim.org> Date: Wed Jun 3 22:57:39 2020 +0200 patch 8.2.0896: crash when calling searchcount() with a string Problem: Crash when calling searchcount() with a string. Solution: Check the argument is a dict. (closes https://github.com/vim/vim/issues/6192)
author Bram Moolenaar <Bram@vim.org>
date Wed, 03 Jun 2020 23:00:03 +0200
parents 635e76ab3722
children 0034b328ddde
files src/search.c src/testdir/test_search_stat.vim src/version.c
diffstat 3 files changed, 14 insertions(+), 2 deletions(-) [+]
line wrap: on
line diff
--- a/src/search.c
+++ b/src/search.c
@@ -3175,7 +3175,7 @@ update_search_stat(
     int		    save_ws = p_ws;
     int		    wraparound = FALSE;
     pos_T	    p = (*pos);
-    static  pos_T   lastpos = {0, 0, 0};
+    static pos_T    lastpos = {0, 0, 0};
     static int	    cur = 0;
     static int	    cnt = 0;
     static int	    exact_match = FALSE;
@@ -4072,11 +4072,17 @@ f_searchcount(typval_T *argvars, typval_
 
     if (argvars[0].v_type != VAR_UNKNOWN)
     {
-	dict_T		*dict = argvars[0].vval.v_dict;
+	dict_T		*dict;
 	dictitem_T	*di;
 	listitem_T	*li;
 	int		error = FALSE;
 
+	if (argvars[0].v_type != VAR_DICT || argvars[0].vval.v_dict == NULL)
+	{
+	    emsg(_(e_dictreq));
+	    return;
+	}
+	dict = argvars[0].vval.v_dict;
 	di = dict_find(dict, (char_u *)"timeout", -1);
 	if (di != NULL)
 	{
--- a/src/testdir/test_search_stat.vim
+++ b/src/testdir/test_search_stat.vim
@@ -259,6 +259,10 @@ func Test_search_stat()
   bwipe!
 endfunc
 
+func Test_searchcount_fails()
+  call assert_fails('echo searchcount("boo!")', 'E715:')
+endfunc
+
 func Test_search_stat_foldopen()
   CheckScreendump
 
--- a/src/version.c
+++ b/src/version.c
@@ -747,6 +747,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    896,
+/**/
     895,
 /**/
     894,