patch 8.2.3585: crash when passing float to "term_rows" of term_start()
Problem: Crash when passing float to "term_rows" in the options argument of
term_start(). (Virginia Senioria)
Solution: Bail out if the argument is not a number. (closes #9116)
diff --git a/src/job.c b/src/job.c
index fcb482c..80cb47e 100644
--- a/src/job.c
+++ b/src/job.c
@@ -424,10 +424,14 @@
}
else if (STRCMP(hi->hi_key, "term_rows") == 0)
{
+ int error = FALSE;
+
if (!(supported2 & JO2_TERM_ROWS))
break;
opt->jo_set2 |= JO2_TERM_ROWS;
- opt->jo_term_rows = tv_get_number(item);
+ opt->jo_term_rows = tv_get_number_chk(item, &error);
+ if (error)
+ return FAIL;
}
else if (STRCMP(hi->hi_key, "term_cols") == 0)
{
diff --git a/src/terminal.c b/src/terminal.c
index bb3035b..1adf690 100644
--- a/src/terminal.c
+++ b/src/terminal.c
@@ -4473,7 +4473,8 @@
static void *
vterm_malloc(size_t size, void *data UNUSED)
{
- return alloc_clear(size);
+ // make sure that the length is not zero
+ return alloc_clear(size == 0 ? 1L : size);
}
static void
diff --git a/src/testdir/test_terminal.vim b/src/testdir/test_terminal.vim
index eb5924a..3e263ef 100644
--- a/src/testdir/test_terminal.vim
+++ b/src/testdir/test_terminal.vim
@@ -467,6 +467,10 @@
bwipe!
call assert_equal([7, 27], size)
+ if has('float')
+ call assert_fails("call term_start(cmd, {'term_rows': 10.0})", 'E805:')
+ endif
+
call delete('Xtext')
endfunc
diff --git a/src/version.c b/src/version.c
index c13ea68..39d1b8a 100644
--- a/src/version.c
+++ b/src/version.c
@@ -758,6 +758,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 3585,
+/**/
3584,
/**/
3583,