From 0d90e728fe089ff1bb34d6a17f5591a96b57f734 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Tue, 3 Nov 2020 18:20:19 +0100
Subject: patch 8.2.1945: crash when passing NULL function to reduce()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Problem:    Crash when passing NULL function to reduce().
Solution:   Check for NULL pointer and give an error. (Dominique Pellé,
            closes #7243)
---
 src/errors.h                  | 2 ++
 src/list.c                    | 7 +++++--
 src/testdir/test_listdict.vim | 3 +++
 src/version.c                 | 2 ++
 4 files changed, 12 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/errors.h b/src/errors.h
index 1843f3d6f..0e0377a0e 100644
--- a/src/errors.h
+++ b/src/errors.h
@@ -286,4 +286,6 @@ EXTERN char e_cannot_add_to_null_list[]
 	INIT(= N_("E1130: Cannot add to null list"));
 EXTERN char e_cannot_add_to_null_blob[]
 	INIT(= N_("E1131: Cannot add to null blob"));
+EXTERN char e_missing_function_argument[]
+	INIT(= N_("E1132: Missing function argument"));
 #endif
diff --git a/src/list.c b/src/list.c
index 1da4f3d0c..beea6fae6 100644
--- a/src/list.c
+++ b/src/list.c
@@ -2552,8 +2552,11 @@ f_reduce(typval_T *argvars, typval_T *rettv)
     }
     else
 	func_name = tv_get_string(&argvars[1]);
-    if (*func_name == NUL)
-	return;		// type error or empty name
+    if (func_name == NULL || *func_name == NUL)
+    {
+	emsg(_(e_missing_function_argument));
+	return;
+    }
 
     vim_memset(&funcexe, 0, sizeof(funcexe));
     funcexe.evaluate = TRUE;
diff --git a/src/testdir/test_listdict.vim b/src/testdir/test_listdict.vim
index ade37f8c0..6a7fc4c68 100644
--- a/src/testdir/test_listdict.vim
+++ b/src/testdir/test_listdict.vim
@@ -740,6 +740,9 @@ func Test_reduce()
 
   call assert_equal(42, reduce(test_null_list(), function('add'), 42))
   call assert_equal(42, reduce(test_null_blob(), function('add'), 42))
+
+  " should not crash
+  call assert_fails('echo reduce([1], test_null_function())', 'E1132:')
 endfunc
 
 " splitting a string to a List using split()
diff --git a/src/version.c b/src/version.c
index 714d038f8..8052de8d5 100644
--- a/src/version.c
+++ b/src/version.c
@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1945,
 /**/
     1944,
 /**/
-- 
cgit v1.2.1