Patch 8.2.4206

[Bram Moolenaar]

Patch 8.2.4206
Problem: Condition with many "(" causes a crash.
Solution: Limit recursion to 1000.
Files: src/errors.h, src/eval.c, src/testdir/test_eval_stuff.vim


*** ../vim-8.2.4205/src/errors.h 2022-01-21 20:37:02.283408897 +0000
--- src/errors.h 2022-01-24 18:08:10.900274110 +0000
***************
*** 2718,2723 ****
--- 2718,2725 ----
INIT(= N_("E1043: Invalid command after :export"));
EXTERN char e_export_with_invalid_argument[]
INIT(= N_("E1044: Export with invalid argument"));
+ // E1045 not used
+ // E1046 not used
EXTERN char e_syntax_error_in_import_str[]
INIT(= N_("E1047: Syntax error in import: %s"));
EXTERN char e_item_not_found_in_script_str[]
***************
*** 2786,2791 ****
--- 2788,2794 ----
// E1080 unused
EXTERN char e_cannot_unlet_str[]
INIT(= N_("E1081: Cannot unlet %s"));
+ // E1082 unused
EXTERN char e_missing_backtick[]
INIT(= N_("E1083: Missing backtick"));
EXTERN char e_cannot_delete_vim9_script_function_str[]
***************
*** 2906,2911 ****
--- 2909,2915 ----
INIT(= N_("E1140: :for argument must be a sequence of lists"));
EXTERN char e_indexable_type_required[]
INIT(= N_("E1141: Indexable type required"));
+ // E1142 unused
EXTERN char e_empty_expression_str[]
INIT(= N_("E1143: Empty expression: \"%s\""));
EXTERN char e_command_str_not_followed_by_white_space_str[]
***************
*** 2966,2972 ****
INIT(= N_("E1167: Argument name shadows existing variable: %s"));
EXTERN char e_argument_already_declared_in_script_str[]
INIT(= N_("E1168: Argument already declared in the script: %s"));
! // E1169 unused
EXTERN char e_cannot_use_hash_curly_to_start_comment[]
INIT(= N_("E1170: Cannot use #{ to start a comment"));
EXTERN char e_missing_end_block[]
--- 2970,2977 ----
INIT(= N_("E1167: Argument name shadows existing variable: %s"));
EXTERN char e_argument_already_declared_in_script_str[]
INIT(= N_("E1168: Argument already declared in the script: %s"));
! EXTERN char e_expression_too_recursive_str[]
! INIT(= N_("E1169: Expression too recursive: %s"));
EXTERN char e_cannot_use_hash_curly_to_start_comment[]
INIT(= N_("E1170: Cannot use #{ to start a comment"));
EXTERN char e_missing_end_block[]
*** ../vim-8.2.4205/src/eval.c 2022-01-22 13:39:04.103476264 +0000
--- src/eval.c 2022-01-24 18:10:03.129877123 +0000
***************
*** 3526,3531 ****
--- 3526,3532 ----
char_u *start_leader, *end_leader;
int ret = OK;
char_u *alias;
+ static int recurse = 0;

/*
* Initialise variable so that clear_tv() can't mistake this for a
***************
*** 3552,3557 ****
--- 3553,3567 ----
return FAIL;
}

+ // Limit recursion to 1000 levels. At least at 10000 we run out of stack
+ // and crash.
+ if (recurse == 1000)
+ {
+ semsg(_(e_expression_too_recursive_str), *arg);
+ return FAIL;
+ }
+ ++recurse;
+
switch (**arg)
{
/*
***************
*** 3781,3786 ****
--- 3791,3798 ----
*/
if (ret == OK && evaluate && end_leader > start_leader)
ret = eval7_leader(rettv, FALSE, start_leader, &end_leader);
+
+ --recurse;
return ret;
}

*** ../vim-8.2.4205/src/testdir/test_eval_stuff.vim 2022-01-12 15:24:36.641292770 +0000
--- src/testdir/test_eval_stuff.vim 2022-01-24 18:13:07.893259414 +0000
***************
*** 590,593 ****
--- 590,598 ----
unlet g:gvar
endfunc

+ func Test_deep_recursion()
+ " this was running out of stack
+ call assert_fails("exe 'if ' .. repeat('(', 1002)", 'E1169: Expression too recursive: ((')
+ endfunc
+
" vim: shiftwidth=2 sts=2 expandtab
*** ../vim-8.2.4205/src/version.c 2022-01-24 16:30:26.564796202 +0000
--- src/version.c 2022-01-24 18:09:12.319061819 +0000
***************
*** 752,753 ****
--- 752,755 ----
{ /* Add new patch number below this line */
+ /**/
+ 4206,
/**/

--
It is illegal for anyone to give lighted cigars to dogs, cats, and other
domesticated animal kept as pets.
[real standing law in Illinois, United States of America]

/// Bram Moolenaar -- Br...@Moolenaar.net -- http://www.Moolenaar.net \\\
/// \\\
\\\ sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ ///
\\\ help me help AIDS victims -- http://ICCF-Holland.org ///