To: vim-dev@vim.org
Subject: Patch 7.2.440
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------
 
Patch 7.2.440
Problem:    Calling a function through a funcref, where the function deletes
	    the funcref, leads to an invalid memory access.
Solution:   Make a copy of the function name. (Lech Lorens)
Files:	    src/eval.c, src/testdir/test34.in, src/testdir/test34.ok
 
 
*** ../vim-7.2.439/src/eval.c	2010-05-16 13:26:19.000000000 +0200
--- src/eval.c	2010-05-28 22:01:07.000000000 +0200
***************
*** 464,470 ****
  static int find_internal_func __ARGS((char_u *name));
  static char_u *deref_func_name __ARGS((char_u *name, int *lenp));
  static int get_func_tv __ARGS((char_u *name, int len, typval_T *rettv, char_u **arg, linenr_T firstline, linenr_T lastline, int *doesrange, int evaluate, dict_T *selfdict));
! static int call_func __ARGS((char_u *name, int len, typval_T *rettv, int argcount, typval_T *argvars, linenr_T firstline, linenr_T lastline, int *doesrange, int evaluate, dict_T *selfdict));
  static void emsg_funcname __ARGS((char *ermsg, char_u *name));
  static int non_zero_arg __ARGS((typval_T *argvars));
  
--- 464,470 ----
  static int find_internal_func __ARGS((char_u *name));
  static char_u *deref_func_name __ARGS((char_u *name, int *lenp));
  static int get_func_tv __ARGS((char_u *name, int len, typval_T *rettv, char_u **arg, linenr_T firstline, linenr_T lastline, int *doesrange, int evaluate, dict_T *selfdict));
! static int call_func __ARGS((char_u *func_name, int len, typval_T *rettv, int argcount, typval_T *argvars, linenr_T firstline, linenr_T lastline, int *doesrange, int evaluate, dict_T *selfdict));
  static void emsg_funcname __ARGS((char *ermsg, char_u *name));
  static int non_zero_arg __ARGS((typval_T *argvars));
  
***************
*** 7997,8005 ****
   * Also returns OK when an error was encountered while executing the function.
   */
      static int
! call_func(name, len, rettv, argcount, argvars, firstline, lastline,
  						doesrange, evaluate, selfdict)
!     char_u	*name;		/* name of the function */
      int		len;		/* length of "name" */
      typval_T	*rettv;		/* return value goes here */
      int		argcount;	/* number of "argvars" */
--- 7997,8005 ----
   * Also returns OK when an error was encountered while executing the function.
   */
      static int
! call_func(func_name, len, rettv, argcount, argvars, firstline, lastline,
  						doesrange, evaluate, selfdict)
!     char_u	*func_name;	/* name of the function */
      int		len;		/* length of "name" */
      typval_T	*rettv;		/* return value goes here */
      int		argcount;	/* number of "argvars" */
***************
*** 8023,8040 ****
      int		i;
      int		llen;
      ufunc_T	*fp;
-     int		cc;
  #define FLEN_FIXED 40
      char_u	fname_buf[FLEN_FIXED + 1];
      char_u	*fname;
  
      /*
       * In a script change <SID>name() and s:name() to K_SNR 123_name().
       * Change <SNR>123_name() to K_SNR 123_name().
       * Use fname_buf[] when it fits, otherwise allocate memory (slow).
       */
-     cc = name[len];
-     name[len] = NUL;
      llen = eval_fname_script(name);
      if (llen > 0)
      {
--- 8023,8044 ----
      int		i;
      int		llen;
      ufunc_T	*fp;
  #define FLEN_FIXED 40
      char_u	fname_buf[FLEN_FIXED + 1];
      char_u	*fname;
+     char_u	*name;
+ 
+     /* Make a copy of the name, if it comes from a funcref variable it could
+      * be changed or deleted in the called function. */
+     name = vim_strnsave(func_name, len);
+     if (name == NULL)
+ 	return ret;
  
      /*
       * In a script change <SID>name() and s:name() to K_SNR 123_name().
       * Change <SNR>123_name() to K_SNR 123_name().
       * Use fname_buf[] when it fits, otherwise allocate memory (slow).
       */
      llen = eval_fname_script(name);
      if (llen > 0)
      {
***************
*** 8205,8213 ****
  	}
      }
  
-     name[len] = cc;
      if (fname != name && fname != fname_buf)
  	vim_free(fname);
  
      return ret;
  }
--- 8209,8217 ----
  	}
      }
  
      if (fname != name && fname != fname_buf)
  	vim_free(fname);
+     vim_free(name);
  
      return ret;
  }
*** ../vim-7.2.439/src/testdir/test34.in	2007-09-25 17:59:15.000000000 +0200
--- src/testdir/test34.in	2010-05-28 21:54:36.000000000 +0200
***************
*** 35,40 ****
--- 35,45 ----
  :  let g:counter = 0
  :  return ''
  :endfunc
+ :func FuncWithRef(a)
+ :  unlet g:FuncRef
+ :  return a:a
+ :endfunc
+ :let g:FuncRef=function("FuncWithRef")
  :let counter = 0
  :inoremap <expr> ( ListItem()
  :inoremap <expr> [ ListReset()
***************
*** 47,52 ****
--- 52,58 ----
   =retval
   =Compute(45, 5, "retval")
   =retval
+  =g:FuncRef(333)
  
  XX+-XX
  ---*---
*** ../vim-7.2.439/src/testdir/test34.ok	2006-04-30 20:49:40.000000000 +0200
--- src/testdir/test34.ok	2010-05-28 21:56:03.000000000 +0200
***************
*** 1,4 ****
! xxx4asdf fail nop ok 9
  XX111XX
  ---222---
  1. one
--- 1,4 ----
! xxx4asdf fail nop ok 9 333
  XX111XX
  ---222---
  1. one
*** ../vim-7.2.439/src/version.c	2010-05-28 21:31:51.000000000 +0200
--- src/version.c	2010-05-28 22:03:30.000000000 +0200
***************
*** 683,684 ****
--- 683,686 ----
  {   /* Add new patch number below this line */
+ /**/
+     440,
  /**/
 
-- 
Nobody will ever need more than 640 kB RAM.
		-- Bill Gates, 1983
Windows 98 requires 16 MB RAM.
		-- Bill Gates, 1999
Logical conclusion: Nobody will ever need Windows 98.
 
 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
\\\        download, build and distribute -- http://www.A-A-P.org        ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///