Commit: patch 9.1.1406: crash when importing invalid tuple

[Christian Brabandt]

patch 9.1.1406: crash when importing invalid tuple

Commit: https://github.com/vim/vim/commit/9772025d24e939fd84b85748ce35c26874c05775
Author: Yegappan Lakshmanan <yega...@yahoo.com>
Date: Fri May 23 17:39:44 2025 +0200

patch 9.1.1406: crash when importing invalid tuple

Problem: crash when importing invalid tuple
(Yang LUO, Yanju Chen)
Solution: set type to VAR_UNKNOWN, so that it isn't freed
(Yegappan Lakshmanan)

closes: #17362

Signed-off-by: Yegappan Lakshmanan <yega...@yahoo.com>
Signed-off-by: Christian Brabandt <c...@256bit.org>

diff --git a/src/testdir/test_tuple.vim b/src/testdir/test_tuple.vim
index e767851af..45f730d86 100644
--- a/src/testdir/test_tuple.vim
+++ b/src/testdir/test_tuple.vim
@@ -1586,6 +1586,17 @@ func Test_recursive_tuple_eval_fails()
\ 'E121: Undefined variable: pat'])
endfunc

+" The following used to crash Vim
+func Test_import_invalid_tuple()
+ let lines =<< trim END
+ imp(",G0}11*f [+\x","#|
+ END
+ new
+ call setline(1, lines)
+ call assert_fails('source', 'E114: Missing double quote: "#|')
+ bw!
+endfunc
+
" Test for add() with a tuple
func Test_tuple_add()
let lines =<< trim END
diff --git a/src/tuple.c b/src/tuple.c
index eff4bdccc..9ca1f3409 100644
--- a/src/tuple.c
+++ b/src/tuple.c
@@ -518,6 +518,9 @@ eval_tuple(char_u **arg, typval_T *rettv, evalarg_T *evalarg, int do_error)
// Add the first item to the tuple from "rettv"
if (tuple_append_tv(tuple, rettv) == FAIL)
return FAIL;
+ // The first item in "rettv" is added to the tuple. Set the rettv
+ // type to unknown, so that the caller doesn't free it.
+ rettv->v_type = VAR_UNKNOWN;
}
}

diff --git a/src/version.c b/src/version.c
index c45c65e7b..b9af08a7d 100644
--- a/src/version.c
+++ b/src/version.c
@@ -709,6 +709,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
+/**/
+ 1406,
/**/
1405,
/**/