Mercurial > vim

comparison src/evalfunc.c @ 32321:b9a8d1c453e1 v9.0.1492

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
patch 9.0.1492: using uninitialized memory when argument is missing Commit: https://github.com/vim/vim/commit/b7f2270bab102d68f83a6300699b7f98efad81f2 Author: Bram Moolenaar <Bram@vim.org> Date: Thu Apr 27 16:24:07 2023 +0100 patch 9.0.1492: using uninitialized memory when argument is missing Problem: Using uninitialized memory when argument is missing. Solution: Check there are sufficient arguments before the base. (closes #12302)
author Bram Moolenaar <Bram@vim.org>
date Thu, 27 Apr 2023 17:30:05 +0200
parents 8d6f53a07ffd
children 3c2c1cb61004
comparison
equal deleted inserted replaced
32320:45c1a530fa76 32321:b9a8d1c453e1
3132 if (argcount + 1 > global_functions[fi].f_max_argc) 3132 if (argcount + 1 > global_functions[fi].f_max_argc)
3133 return FCERR_TOOMANY; 3133 return FCERR_TOOMANY;
3134 3134
3135 if (global_functions[fi].f_argtype == FEARG_2) 3135 if (global_functions[fi].f_argtype == FEARG_2)
3136 { 3136 {
3137 if (argcount < 1)
3138 return FCERR_TOOFEW;
3139
3137 // base value goes second 3140 // base value goes second
3138 argv[0] = argvars[0]; 3141 argv[0] = argvars[0];
3139 argv[1] = *basetv; 3142 argv[1] = *basetv;
3140 for (int i = 1; i < argcount; ++i) 3143 for (int i = 1; i < argcount; ++i)
3141 argv[i + 1] = argvars[i]; 3144 argv[i + 1] = argvars[i];
3142 } 3145 }
3143 else if (global_functions[fi].f_argtype == FEARG_3) 3146 else if (global_functions[fi].f_argtype == FEARG_3)
3144 { 3147 {
3148 if (argcount < 2)
3149 return FCERR_TOOFEW;
3150
3145 // base value goes third 3151 // base value goes third
3146 argv[0] = argvars[0]; 3152 argv[0] = argvars[0];
3147 argv[1] = argvars[1]; 3153 argv[1] = argvars[1];
3148 argv[2] = *basetv; 3154 argv[2] = *basetv;
3149 for (int i = 2; i < argcount; ++i) 3155 for (int i = 2; i < argcount; ++i)
3150 argv[i + 1] = argvars[i]; 3156 argv[i + 1] = argvars[i];
3151 } 3157 }
3152 else if (global_functions[fi].f_argtype == FEARG_4) 3158 else if (global_functions[fi].f_argtype == FEARG_4)
3153 { 3159 {
3160 if (argcount < 3)
3161 return FCERR_TOOFEW;
3162
3154 // base value goes fourth 3163 // base value goes fourth
3155 argv[0] = argvars[0]; 3164 argv[0] = argvars[0];
3156 argv[1] = argvars[1]; 3165 argv[1] = argvars[1];
3157 argv[2] = argvars[2]; 3166 argv[2] = argvars[2];
3158 argv[3] = *basetv; 3167 argv[3] = *basetv;