neovim

commit d13222649a2145272f14675d9bbf64bb72c43f64
parent 6adfd24a066c207334609a6b149ada19c0f568d4
Author: zeertzjq <zeertzjq@outlook.com>
Date:   Sun, 16 Apr 2023 08:58:37 +0800

vim-patch:8.2.1945: crash when passing NULL function to reduce()

Problem:    Crash when passing NULL function to reduce().
Solution:   Check for NULL pointer and give an error. (Dominique Pellé,
            closes vim/vim#7243)

https://github.com/vim/vim/commit/0d90e728fe089ff1bb34d6a17f5591a96b57f734

Co-authored-by: Bram Moolenaar <Bram@vim.org>

Diffstat:
M
src/nvim/eval/funcs.c
 | 
7
+++++--
M
test/old/testdir/test_listdict.vim
 | 
4
++++

2 files changed, 9 insertions(+), 2 deletions(-)
diff --git a/src/nvim/eval/funcs.c b/src/nvim/eval/funcs.c
@@ -150,6 +150,8 @@ static const char *e_invalwindow = N_("E957: Invalid window number");
 static const char *e_reduceempty = N_("E998: Reduce of an empty %s with no initial value");
 static const char e_using_number_as_bool_nr[]
   = N_("E1023: Using a Number as a Bool: %d");
+static const char e_missing_function_argument[]
+  = N_("E1132: Missing function argument");
 
 /// Dummy va_list for passing to vim_snprintf
 ///
@@ -6244,8 +6246,9 @@ static void f_reduce(typval_T *argvars, typval_T *rettv, EvalFuncData fptr)
   } else {
     func_name = tv_get_string(&argvars[1]);
   }
-  if (*func_name == NUL) {
-    return;  // type error or empty name
+  if (func_name == NULL || *func_name == NUL) {
+    emsg(_(e_missing_function_argument));
+    return;
   }
 
   funcexe_T funcexe = FUNCEXE_INIT;
diff --git a/test/old/testdir/test_listdict.vim b/test/old/testdir/test_listdict.vim
@@ -747,6 +747,10 @@ func Test_reduce()
 
   call assert_equal(42, reduce(v:_null_list, function('add'), 42))
   call assert_equal(42, reduce(v:_null_blob, function('add'), 42))
+
+  " should not crash
+  " Nvim doesn't have null functions
+  " call assert_fails('echo reduce([1], test_null_function())', 'E1132:')
 endfunc
 
 " splitting a string to a List using split()