From 66624ff0d9e1de2fc5eb4f95f3a3a2ed70b10138 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Wed, 3 Feb 2016 23:59:43 +0100
Subject: patch 7.4.1255 Problem:    Crash for channel "eval" command without
 third argument. Solution:   Check for missing argument.

---
 src/channel.c                |  4 ++--
 src/testdir/test_channel.py  | 10 ++++++++--
 src/testdir/test_channel.vim |  4 ++++
 src/version.c                |  2 ++
 4 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/src/channel.c b/src/channel.c
index 9e15fe455..b9a2a972f 100644
--- a/src/channel.c
+++ b/src/channel.c
@@ -694,7 +694,7 @@ channel_exe_cmd(int idx, char_u *cmd, typval_T *arg2, typval_T *arg3)
     {
 	int is_eval = cmd[1] == 'v';
 
-	if (is_eval && arg3->v_type != VAR_NUMBER)
+	if (is_eval && (arg3 == NULL || arg3->v_type != VAR_NUMBER))
 	{
 	    if (p_verbose > 2)
 		EMSG("E904: third argument for eval must be a number");
@@ -774,7 +774,7 @@ may_invoke_callback(int idx)
 	    typval_T	*arg3 = NULL;
 	    char_u	*cmd = typetv->vval.v_string;
 
-	    /* ["cmd", arg] */
+	    /* ["cmd", arg] or ["cmd", arg, arg] */
 	    if (list->lv_len == 3)
 		arg3 = &list->lv_last->li_tv;
 	    channel_exe_cmd(idx, cmd, &argv[1], arg3);
diff --git a/src/testdir/test_channel.py b/src/testdir/test_channel.py
index f1d774fd1..dbf9eb2c7 100644
--- a/src/testdir/test_channel.py
+++ b/src/testdir/test_channel.py
@@ -68,8 +68,8 @@ class ThreadedTCPRequestHandler(socketserver.BaseRequestHandler):
                         # simply send back a string
                         response = "got it"
                     elif decoded[1] == 'make change':
-                        # Send two ex commands at the same time, before replying to
-                        # the request.
+                        # Send two ex commands at the same time, before
+                        # replying to the request.
                         cmd = '["ex","call append(\\"$\\",\\"added1\\")"]'
                         cmd += '["ex","call append(\\"$\\",\\"added2\\")"]'
                         print("sending: {}".format(cmd))
@@ -87,6 +87,12 @@ class ThreadedTCPRequestHandler(socketserver.BaseRequestHandler):
                         print("sending: {}".format(cmd))
                         self.request.sendall(cmd.encode('utf-8'))
                         response = "ok"
+                    elif decoded[1] == 'eval-bad':
+                        # Send an eval request missing the third argument.
+                        cmd = '["eval","xxx"]'
+                        print("sending: {}".format(cmd))
+                        self.request.sendall(cmd.encode('utf-8'))
+                        response = "ok"
                     elif decoded[1] == 'eval-result':
                         # Send back the last received eval result.
                         response = last_eval
diff --git a/src/testdir/test_channel.vim b/src/testdir/test_channel.vim
index b416520e4..3caf5d21d 100644
--- a/src/testdir/test_channel.vim
+++ b/src/testdir/test_channel.vim
@@ -90,6 +90,10 @@ func Test_communicate()
   call assert_equal('ok', ch_sendexpr(handle, 'eval-fails'))
   call assert_equal([-2, 'ERROR'], ch_sendexpr(handle, 'eval-result'))
 
+  " Send a bad eval request. There will be no response.
+  call assert_equal('ok', ch_sendexpr(handle, 'eval-bad'))
+  call assert_equal([-2, 'ERROR'], ch_sendexpr(handle, 'eval-result'))
+
   " make the server quit, can't check if this works, should not hang.
   call ch_sendexpr(handle, '!quit!', 0)
 
diff --git a/src/version.c b/src/version.c
index 6a86d6a36..0f87c416f 100644
--- a/src/version.c
+++ b/src/version.c
@@ -742,6 +742,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1255,
 /**/
     1254,
 /**/
-- 
cgit v1.2.1