patch 8.2.3585: crash when passing float to "term_rows" of term_start()

Problem:    Crash when passing float to "term_rows" in the options argument of
            term_start(). (Virginia Senioria)
Solution:   Bail out if the argument is not a number. (closes #9116)

diff --git a/src/job.c b/src/job.c
index fcb482c7066e434c4d055547af8be80883474961..80cb47eeb179d4aada39987f7e57d7f725134f1f 100644 (file)
--- a/src/job.c
+++ b/src/job.c
@@ -424,10 +424,14 @@ get_job_options(typval_T *tv, jobopt_T *opt, int supported, int supported2)
            }
            else if (STRCMP(hi->hi_key, "term_rows") == 0)
            {
+               int error = FALSE;
+
                if (!(supported2 & JO2_TERM_ROWS))
                    break;
                opt->jo_set2 |= JO2_TERM_ROWS;
-               opt->jo_term_rows = tv_get_number(item);
+               opt->jo_term_rows = tv_get_number_chk(item, &error);
+               if (error)
+                   return FAIL;
            }
            else if (STRCMP(hi->hi_key, "term_cols") == 0)
            {

diff --git a/src/terminal.c b/src/terminal.c
index bb3035bdfd15740031ae15f0a6ea7c8c6110d5c8..1adf690adefc1465e9eef6d2ac0ca93f2f1ea41f 100644 (file)
--- a/src/terminal.c
+++ b/src/terminal.c
@@ -4473,7 +4473,8 @@ static VTermStateFallbacks state_fallbacks = {
     static void *
 vterm_malloc(size_t size, void *data UNUSED)
 {
-    return alloc_clear(size);
+    // make sure that the length is not zero
+    return alloc_clear(size == 0 ? 1L : size);
 }
 
     static void

diff --git a/src/testdir/test_terminal.vim b/src/testdir/test_terminal.vim
index eb5924a3010a31c37492fb5a8d929e0c1c1b368b..3e263efd2723c66aa7b0e6e4c885b9fb55fba488 100644 (file)
--- a/src/testdir/test_terminal.vim
+++ b/src/testdir/test_terminal.vim
@@ -467,6 +467,10 @@ func Test_terminal_size()
   bwipe!
   call assert_equal([7, 27], size)
 
+  if has('float')
+    call assert_fails("call term_start(cmd, {'term_rows': 10.0})", 'E805:')
+  endif
+
   call delete('Xtext')
 endfunc
 

diff --git a/src/version.c b/src/version.c
index c13ea68b96d39b07e2ab98bd107a8fb6ca5a6c09..39d1b8ab76006f88e332bbd5d2598d18889de4c2 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -757,6 +757,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    3585,
 /**/
     3584,
 /**/