patch 8.0.1429: crash when calling term_start() with empty argument

Problem:    Crash when calling term_start() with empty argument.
Solution:   Check for invalid argument. (Yasuhiro Matsomoto, closes #2503)
            Fix memory leak.

diff --git a/src/terminal.c b/src/terminal.c
index 744b7dedfb0fd4b3cbd3322397409fd4528884d8..0cff47a729d1d8c31499e9c93216e181b49ad28a 100644 (file)
--- a/src/terminal.c
+++ b/src/terminal.c
@@ -42,6 +42,7 @@
  *   a job that uses 16 colors while Vim is using > 256.
  * - in GUI vertical split causes problems.  Cursor is flickering. (Hirohito
  *   Higashi, 2017 Sep 19)
+ * - Trigger TerminalOpen event?  #2422  patch in #2484
  * - Shift-Tab does not work.
  * - after resizing windows overlap. (Boris Staletic, #2164)
  * - Redirecting output does not work on MS-Windows, Test_terminal_redir_file()
@@ -62,6 +63,8 @@
  * - add test for giving error for invalid 'termsize' value.
  * - support minimal size when 'termsize' is "rows*cols".
  * - support minimal size when 'termsize' is empty?
+ * - if the job in the terminal does not support the mouse, we can use the
+ *   mouse in the Terminal window for copy/paste and scrolling.
  * - GUI: when using tabs, focus in terminal, click on tab does not work.
  * - GUI: when 'confirm' is set and trying to exit Vim, dialog offers to save
  *   changes to "!shell".
@@ -69,8 +72,6 @@
  * - Redrawing is slow with Athena and Motif.  Also other GUI? (Ramel Eshed)
  * - For the GUI fill termios with default values, perhaps like pangoterm:
  *   http://bazaar.launchpad.net/~leonerd/pangoterm/trunk/view/head:/main.c#L134
- * - if the job in the terminal does not support the mouse, we can use the
- *   mouse in the Terminal window for copy/paste.
  * - when 'encoding' is not utf-8, or the job is using another encoding, setup
  *   conversions.
  * - In the GUI use a terminal emulator for :!cmd.  Make the height the same as
@@ -3388,28 +3389,36 @@ term_and_job_init(
     void           *winpty_err;
     void           *spawn_config = NULL;
     garray_T       ga_cmd, ga_env;
-    char_u         *cmd;
+    char_u         *cmd = NULL;
 
     if (dyn_winpty_init(TRUE) == FAIL)
        return FAIL;
+    ga_init2(&ga_cmd, (int)sizeof(char*), 20);
+    ga_init2(&ga_env, (int)sizeof(char*), 20);
 
     if (argvar->v_type == VAR_STRING)
+    {
        cmd = argvar->vval.v_string;
-    else
+    }
+    else if (argvar->v_type == VAR_LIST)
     {
-       ga_init2(&ga_cmd, (int)sizeof(char*), 20);
        if (win32_build_cmd(argvar->vval.v_list, &ga_cmd) == FAIL)
            goto failed;
        cmd = ga_cmd.ga_data;
     }
+    if (cmd == NULL || *cmd == NUL)
+    {
+       EMSG(_(e_invarg));
+       goto failed;
+    }
 
     cmd_wchar = enc_to_utf16(cmd, NULL);
+    ga_clear(&ga_cmd);
     if (cmd_wchar == NULL)
-       return FAIL;
+       goto failed;
     if (opt->jo_cwd != NULL)
        cwd_wchar = enc_to_utf16(opt->jo_cwd, NULL);
 
-    ga_init2(&ga_env, (int)sizeof(char*), 20);
     win32_build_env(opt->jo_env, &ga_env, TRUE);
     env_wchar = ga_env.ga_data;
 
@@ -3490,6 +3499,7 @@ term_and_job_init(
     winpty_spawn_config_free(spawn_config);
     vim_free(cmd_wchar);
     vim_free(cwd_wchar);
+    vim_free(env_wchar);
 
     create_vterm(term, term->tl_rows, term->tl_cols);
 
@@ -3511,9 +3521,8 @@ term_and_job_init(
     return OK;
 
 failed:
-    if (argvar->v_type == VAR_LIST)
-       vim_free(ga_cmd.ga_data);
-    vim_free(ga_env.ga_data);
+    ga_clear(&ga_cmd);
+    ga_clear(&ga_env);
     vim_free(cmd_wchar);
     vim_free(cwd_wchar);
     if (spawn_config != NULL)

diff --git a/src/testdir/test_terminal.vim b/src/testdir/test_terminal.vim
index cb04edfb7d944f16ac8b17ffa5420a3ddf4ee0fa..3116b803f14e74ec678121da45d5cac21b35d345 100644 (file)
--- a/src/testdir/test_terminal.vim
+++ b/src/testdir/test_terminal.vim
@@ -795,3 +795,14 @@ func Test_terminal_aucmd_on_close()
   au! repro
   delfunc Nop
 endfunc
+
+func Test_terminal_term_start_empty_command()
+  let cmd = "call term_start('', {'curwin' : 1, 'term_finish' : 'close'})"
+  call assert_fails(cmd, 'E474')
+  let cmd = "call term_start('', {'curwin' : 1, 'term_finish' : 'close'})"
+  call assert_fails(cmd, 'E474')
+  let cmd = "call term_start({}, {'curwin' : 1, 'term_finish' : 'close'})"
+  call assert_fails(cmd, 'E474')
+  let cmd = "call term_start(0, {'curwin' : 1, 'term_finish' : 'close'})"
+  call assert_fails(cmd, 'E474')
+endfunc

diff --git a/src/version.c b/src/version.c
index 2bfb86c24e5fc5a98d450097d6b1fb90b0311e87..a204e7cfe0710f1f2384cc77b673d0cc484a13b3 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -771,6 +771,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1429,
 /**/
     1428,
 /**/