patch 7.4.1264v7.4.1264

Problem:    Crash when receiving an empty array.
Solution:   Check for array with wrong number of arguments. (Damien)

4 files changed, 17 insertions, 23 deletions

diff --git a/src/channel.c b/src/channel.c
index cab920c22b..35875ca9a7 100644
--- a/src/channel.c
+++ b/src/channel.c
@@ -688,7 +688,9 @@ channel_parse_json(int ch_idx)
     ret = json_decode(&reader, &listtv);
     if (ret == OK)
     {
-	if (listtv.v_type != VAR_LIST)
+	/* Only accept the response when it is a list with at least two
+	 * items. */
+	if (listtv.v_type != VAR_LIST || listtv.vval.v_list->lv_len < 2)
 	{
 	    /* TODO: give error */
 	    clear_tv(&listtv);
@@ -909,13 +911,6 @@ may_invoke_callback(int idx)
 	}
 
 	list = listtv->vval.v_list;
-	if (list->lv_len < 2)
-	{
-	    /* TODO: give error */
-	    clear_tv(listtv);
-	    return FALSE;
-	}
-
 	argv[1] = list->lv_first->li_next->li_tv;
 	typetv = &list->lv_first->li_tv;
 	if (typetv->v_type == VAR_STRING)
diff --git a/src/eval.c b/src/eval.c
index 50b1b2aef9..33ec495e83 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -9875,18 +9875,12 @@ f_ch_sendexpr(typval_T *argvars, typval_T *rettv)
     {
 	if (channel_read_json_block(ch_idx, id, &listtv) == OK)
 	{
-	    if (listtv->v_type == VAR_LIST)
-	    {
-		list_T *list = listtv->vval.v_list;
+	    list_T *list = listtv->vval.v_list;
 
-		if (list->lv_len == 2)
-		{
-		    /* Move the item from the list and then change the type to
-		     * avoid the value being freed. */
-		    *rettv = list->lv_last->li_tv;
-		    list->lv_last->li_tv.v_type = VAR_NUMBER;
-		}
-	    }
+	    /* Move the item from the list and then change the type to
+	     * avoid the value being freed. */
+	    *rettv = list->lv_last->li_tv;
+	    list->lv_last->li_tv.v_type = VAR_NUMBER;
 	    clear_tv(listtv);
 	}
     }
diff --git a/src/testdir/test_channel.py b/src/testdir/test_channel.py
index fb75938c1f..66b8c5e665 100644
--- a/src/testdir/test_channel.py
+++ b/src/testdir/test_channel.py
@@ -93,6 +93,11 @@ class ThreadedTCPRequestHandler(socketserver.BaseRequestHandler):
                         print("sending: {}".format(cmd))
                         self.request.sendall(cmd.encode('utf-8'))
                         response = "ok"
+                    elif decoded[1] == 'empty-request':
+                        cmd = '[]'
+                        print("sending: {}".format(cmd))
+                        self.request.sendall(cmd.encode('utf-8'))
+                        response = "ok"
                     elif decoded[1] == 'eval-result':
                         # Send back the last received eval result.
                         response = last_eval
@@ -123,11 +128,9 @@ if __name__ == "__main__":
     server = ThreadedTCPServer((HOST, PORT), ThreadedTCPRequestHandler)
     ip, port = server.server_address
 
-    # Start a thread with the server -- that thread will then start one
-    # more thread for each request
+    # Start a thread with the server.  That thread will then start a new thread
+    # for each connection.
     server_thread = threading.Thread(target=server.serve_forever)
-
-    # Exit the server thread when the main thread terminates
     server_thread.start()
 
     # Write the port number in Xportnr, so that the test knows it.
diff --git a/src/version.c b/src/version.c
index 4f8f454e41..9939665f6b 100644
--- a/src/version.c
+++ b/src/version.c
@@ -743,6 +743,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1264,
+/**/
     1263,
 /**/
     1262,