patch 8.2.2585: Vim9: illegal memory access

Problem:    Vim9: illegal memory access.
Solution:   Check byte right after "null", not one more.

src/drawline.c

@@ -1034,7 +1034,7 @@ win_line(
 		    p_extra_free = alloc(MAX_MCO * fdc + 1);
 		    if (p_extra_free != NULL)
 		    {
-			n_extra = fill_foldcolumn(p_extra_free, wp,
+			n_extra = (int)fill_foldcolumn(p_extra_free, wp,
 								  FALSE, lnum);
 			p_extra_free[n_extra] = NUL;
 			p_extra = p_extra_free;

src/evalfunc.c

@@ -1021,7 +1021,7 @@ static funcentry_T global_functions[] =
     {"getcwd",		0, 2, FEARG_1,	    NULL,
 			ret_string,	    f_getcwd},
     {"getenv",		1, 1, FEARG_1,	    NULL,
-			ret_string,	    f_getenv},
+			ret_any,	    f_getenv},
     {"getfontname",	0, 1, 0,	    NULL,
 			ret_string,	    f_getfontname},
     {"getfperm",	1, 1, FEARG_1,	    NULL,

src/evalvars.c

@@ -319,7 +319,8 @@ garbage_collect_scriptvars(int copyID)
 	{
 	    svar_T    *sv = ((svar_T *)si->sn_var_vals.ga_data) + idx;
 
-	    abort = abort || set_ref_in_item(sv->sv_tv, copyID, NULL, NULL);
+	    if (sv->sv_name != NULL)
+		abort = abort || set_ref_in_item(sv->sv_tv, copyID, NULL, NULL);
 	}
     }
 

src/if_lua.c

@@ -568,6 +568,11 @@ luaV_pushtypval(lua_State *L, typval_T *tv)
 	case VAR_FUNC:
 	    luaV_pushfuncref(L, tv->vval.v_string);
 	    break;
+	case VAR_PARTIAL:
+	    // TODO: handle partial arguments
+	    luaV_pushfuncref(L, partial_name(tv->vval.v_partial));
+	    break;
+
 	case VAR_BLOB:
 	    luaV_pushblob(L, tv->vval.v_blob);
 	    break;

src/option.c

@@ -3176,7 +3176,9 @@ set_bool_option(
     if (curwin->w_curswant != MAXCOL
 		     && (options[opt_idx].flags & (P_CURSWANT | P_RALL)) != 0)
 	curwin->w_set_curswant = TRUE;
-    check_redraw(options[opt_idx].flags);
+
+    if ((opt_flags & OPT_NO_REDRAW) == 0)
+	check_redraw(options[opt_idx].flags);
 
     return NULL;
 }
@@ -3192,8 +3194,8 @@ set_num_option(
     long	value,			// new value
     char	*errbuf,		// buffer for error messages
     size_t	errbuflen,		// length of "errbuf"
-    int		opt_flags)		// OPT_LOCAL, OPT_GLOBAL and
-					// OPT_MODELINE
+    int		opt_flags)		// OPT_LOCAL, OPT_GLOBAL,
+					// OPT_MODELINE, etc.
 {
     char	*errmsg = NULL;
     long	old_value = *(long *)varp;
@@ -3734,7 +3736,8 @@ set_num_option(
     if (curwin->w_curswant != MAXCOL
 		     && (options[opt_idx].flags & (P_CURSWANT | P_RALL)) != 0)
 	curwin->w_set_curswant = TRUE;
-    check_redraw(options[opt_idx].flags);
+    if ((opt_flags & OPT_NO_REDRAW) == 0)
+	check_redraw(options[opt_idx].flags);
 
     return errmsg;
 }

src/optionstr.c

@@ -2461,11 +2461,14 @@ ambw_end:
 		   && (get_option_flags(opt_idx) & (P_CURSWANT | P_RALL)) != 0)
 	curwin->w_set_curswant = TRUE;
 
+    if ((opt_flags & OPT_NO_REDRAW) == 0)
+    {
 #ifdef FEAT_GUI
-    // check redraw when it's not a GUI option or the GUI is active.
-    if (!redraw_gui_only || gui.in_use)
+	// check redraw when it's not a GUI option or the GUI is active.
+	if (!redraw_gui_only || gui.in_use)
 #endif
-	check_redraw(get_option_flags(opt_idx));
+	    check_redraw(get_option_flags(opt_idx));
+    }
 
 #if defined(FEAT_VTP) && defined(FEAT_TERMGUICOLORS)
     if (did_swaptcap)

src/scriptfile.c

@@ -1459,7 +1459,7 @@ almosttheend:
     si = SCRIPT_ITEM(current_sctx.sc_sid);
     if (si->sn_save_cpo != NULL)
     {
-	set_option_value((char_u *)"cpo", 0L, si->sn_save_cpo, 0);
+	set_option_value((char_u *)"cpo", 0L, si->sn_save_cpo, OPT_NO_REDRAW);
 	VIM_CLEAR(si->sn_save_cpo);
     }
 

src/testdir/dumps/Test_vim9_no_redraw.dump

@@ -0,0 +1,6 @@
+|s+0&#ffffff0|o+0&#e0e0e08|m|e| |t|e|x|t| | +0&#ffffff0@64
+|~+0#4040ff13&| @73
+|~| @73
+|~| @73
+|~| @73
+|:+0#0000000&|'|<|,|'|>> @68

src/testdir/test_lua.vim

@@ -121,6 +121,15 @@ func Test_lua_eval()
   lua v = nil
 endfunc
 
+" Test luaeval() with lambda
+func Test_luaeval_with_lambda()
+  lua function hello_luaeval_lambda(a, cb) return a .. cb() end
+  call assert_equal('helloworld',
+        \ luaeval('hello_luaeval_lambda(_A[1], _A[2])',
+        \         ['hello', {->'world'}]))
+  lua hello_luaeval_lambda = nil
+endfunc
+
 " Test vim.window()
 func Test_lua_window()
   e Xfoo2

src/testdir/test_vim9_builtin.vim

@@ -472,6 +472,19 @@ def Test_getchar()
   getchar(true)->assert_equal(0)
 enddef
 
+def Test_getenv()
+  if getenv('does-not_exist') == ''
+    assert_report('getenv() should return null')
+  endif
+  if getenv('does-not_exist') == null
+  else
+    assert_report('getenv() should return null')
+  endif
+  $SOMEENVVAR = 'some'
+  assert_equal('some', getenv('SOMEENVVAR'))
+  unlet $SOMEENVVAR
+enddef
+
 def Test_getcompletion()
   set wildignore=*.vim,*~
   var l = getcompletion('run', 'file', true)

src/testdir/test_vim9_expr.vim

@@ -1370,6 +1370,9 @@ def Test_expr5_list_add()
     dany[i] = i
   endfor
   assert_equal({a: 'a', 12: 12}, dany)
+
+  # result of glob() is "any", runtime type check
+  var sl: list<string> = glob('*.txt', false, true) + ['']
 enddef
 
 " test multiply, divide, modulo

src/testdir/test_vim9_func.vim

@@ -1136,6 +1136,23 @@ def Test_arg_type_wrong()
   CheckScriptFailure(['def Func5(items)', 'echo "a"'], 'E1077:')
 enddef
 
+def Test_white_space_after_comma()
+  var lines =<< trim END
+    vim9script
+    def Func(a: number,b: number)
+    enddef
+  END
+  CheckScriptFailure(lines, 'E1069:')
+
+  # OK in legacy function
+  lines =<< trim END
+    vim9script
+    func Func(a,b)
+    endfunc
+  END
+  CheckScriptSuccess(lines)
+enddef
+
 def Test_vim9script_call()
   var lines =<< trim END
     vim9script

src/testdir/test_vim9_script.vim

@@ -5,6 +5,7 @@ source term_util.vim
 source view_util.vim
 source vim9.vim
 source shared.vim
+source screendump.vim
 
 def Test_range_only()
   new
@@ -3154,6 +3155,10 @@ def Test_vim9_autoload()
        return 'test'
      enddef
      g:some#name = 'name'
+
+     def some#varargs(a1: string, ...l: list<string>): string
+       return a1 .. l[0] .. l[1]
+     enddef
   END
 
   mkdir('Xdir/autoload', 'p')
@@ -3166,6 +3171,8 @@ def Test_vim9_autoload()
   g:some#other = 'other'
   assert_equal('other', g:some#other)
 
+  assert_equal('abc', some#varargs('a', 'b', 'c'))
+
   # upper case script name works
   lines =<< trim END
      vim9script
@@ -3332,6 +3339,38 @@ def Test_restoring_cpo()
   set cpo&vim
 enddef
 
+" Use :function so we can use Check commands
+func Test_no_redraw_when_restoring_cpo()
+  CheckScreendump
+  CheckFeature timers
+
+  let lines =<< trim END
+    vim9script
+    def script#func()
+    enddef
+  END
+  call mkdir('Xdir/autoload', 'p')
+  call writefile(lines, 'Xdir/autoload/script.vim')
+
+  let lines =<< trim END
+      vim9script
+      set cpo+=M
+      exe 'set rtp^=' .. getcwd() .. '/Xdir'
+      au CmdlineEnter : ++once timer_start(0, () => script#func())
+      setline(1, 'some text')
+  END
+  call writefile(lines, 'XTest_redraw_cpo')
+  let buf = RunVimInTerminal('-S XTest_redraw_cpo', {'rows': 6})
+  call term_sendkeys(buf, "V:")
+  call VerifyScreenDump(buf, 'Test_vim9_no_redraw', {})
+
+  " clean up
+  call term_sendkeys(buf, "\<Esc>u")
+  call StopVimInTerminal(buf)
+  call delete('XTest_redraw_cpo')
+  call delete('Xdir', 'rf')
+endfunc
+
 
 def Test_unset_any_variable()
   var lines =<< trim END

src/userfunc.c

@@ -310,7 +310,8 @@ get_function_args(
 		++p;
 		// Don't give this error when skipping, it makes the "->" not
 		// found in "{k,v -> x}" and give a confusing error.
-		if (!skip && in_vim9script()
+		// Allow missing space after comma in legacy functions.
+		if (!skip && argtypes != NULL
 				      && !IS_WHITE_OR_NUL(*p) && *p != endchar)
 		{
 		    semsg(_(e_white_space_required_after_str_str), ",", p - 1);

src/version.c

@@ -750,6 +750,26 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2585,
+/**/
+    2584,
+/**/
+    2583,
+/**/
+    2582,
+/**/
+    2581,
+/**/
+    2580,
+/**/
+    2579,
+/**/
+    2578,
+/**/
+    2577,
+/**/
+    2576,
 /**/
     2575,
 /**/

src/vim.h

@@ -1200,6 +1200,7 @@ extern int (*dyn_libintl_wputenv)(const wchar_t *envstring);
 #define OPT_WINONLY	0x10	// only set window-local options
 #define OPT_NOWIN	0x20	// don't set window-local options
 #define OPT_ONECOLUMN	0x40	// list options one per line
+#define OPT_NO_REDRAW	0x80	// ignore redraw flags on option
 
 // Magic chars used in confirm dialog strings
 #define DLG_BUTTON_SEP	'\n'

src/vim9compile.c

@@ -4184,7 +4184,7 @@ compile_expr7(
 	 * "null" constant
 	 */
 	case 'n':   if (STRNCMP(*arg, "null", 4) == 0
-						   && !eval_isnamec((*arg)[5]))
+						   && !eval_isnamec((*arg)[4]))
 		    {
 			*arg += 4;
 			rettv->v_type = VAR_SPECIAL;
@@ -4450,7 +4450,7 @@ compile_expr6(char_u **arg, cctx_T *cctx, ppconst_T *ppconst)
 }
 
 /*
- *      +	number addition
+ *      +	number addition or list/blobl concatenation
  *      -	number subtraction
  *      ..	string concatenation
  */
@@ -4532,6 +4532,7 @@ compile_expr5(char_u **arg, cctx_T *cctx, ppconst_T *ppconst)
 	else
 	{
 	    generate_ppconst(cctx, ppconst);
+	    ppconst->pp_is_const = FALSE;
 	    if (*op == '.')
 	    {
 		if (may_generate_2STRING(-2, cctx) == FAIL

src/vim9execute.c

@@ -807,9 +807,12 @@ call_by_name(char_u *name, int argcount, ectx_T *ectx, isn_T *iptr)
 	    // types are correct.
 	    for (i = 0; i < argcount; ++i)
 	    {
-		type_T *type = i < ufunc->uf_args.ga_len
-				  ? ufunc->uf_arg_types[i] : ufunc->uf_va_type;
+		type_T *type = NULL;
 
+		if (i < ufunc->uf_args.ga_len)
+		    type = ufunc->uf_arg_types[i];
+		else if (ufunc->uf_va_type != NULL)
+		    type = ufunc->uf_va_type->tt_member;
 		if (type != NULL && check_typval_arg_type(type,
 						      &argv[i], i + 1) == FAIL)
 		    return FAIL;

src/vim9script.c

@@ -75,7 +75,7 @@ ex_vim9script(exarg_T *eap UNUSED)
     if (STRCMP(p_cpo, CPO_VIM) != 0)
     {
 	si->sn_save_cpo = vim_strsave(p_cpo);
-	set_option_value((char_u *)"cpo", 0L, (char_u *)CPO_VIM, 0);
+	set_option_value((char_u *)"cpo", 0L, (char_u *)CPO_VIM, OPT_NO_REDRAW);
     }
 #else
     // No check for this being the first command, it doesn't matter.