From: Bram Moolenaar <Bram@vim.org>
Date: Tue, 27 Dec 2022 17:25:05 +0000 (+0000)
Subject: patch 9.0.1104: invalid memory access when checking function argument types
X-Git-Tag: v9.0.1104
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=56310d38d8e866085108c7b77b756f4373d5122a;p=vim

patch 9.0.1104: invalid memory access when checking function argument types

Problem:    Invalid memory access when checking function argument types.
Solution:   Do not check beyond the number of arguments. (closes #11755)
---

diff --git a/src/testdir/test_vim9_func.vim b/src/testdir/test_vim9_func.vim
index a5e3e9025..0edf7eab7 100644
--- a/src/testdir/test_vim9_func.vim
+++ b/src/testdir/test_vim9_func.vim
@@ -426,6 +426,16 @@ def Test_check_argument_type()
       Func()
   END
   v9.CheckScriptFailure(lines, 'E1013: Argument 2: type mismatch, expected number but got bool', 2)
+
+  lines =<< trim END
+      vim9script
+
+      def Foobar(Fn: func(any, ?string): any)
+      enddef
+
+      Foobar((t) => 0)
+  END
+  v9.CheckScriptSuccess(lines)
 enddef
 
 def Test_missing_return()
diff --git a/src/version.c b/src/version.c
index b33f6d5a8..8dbf11f89 100644
--- a/src/version.c
+++ b/src/version.c
@@ -695,6 +695,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1104,
 /**/
     1103,
 /**/
diff --git a/src/vim9type.c b/src/vim9type.c
index 0709ce043..393c69d7e 100644
--- a/src/vim9type.c
+++ b/src/vim9type.c
@@ -848,7 +848,7 @@ check_type_maybe(
 	    {
 		int i;
 
-		for (i = 0; i < expected->tt_argcount; ++i)
+		for (i = 0; i < expected->tt_argcount && i < actual->tt_argcount; ++i)
 		    // Allow for using "any" argument type, lambda's have them.
 		    if (actual->tt_args[i] != &t_any && check_type(
 			    expected->tt_args[i], actual->tt_args[i], FALSE,