Array overrun fix in apply.

* eval.c (APPLY_ARGS): New preprocessor symbol, replaces
hard-coded 32 inside apply.
(apply): Use APPLY_ARGS for argument array.
Fix overrun of args array in non-variadic function case when
list has more than APPLY_ARGS elements.
Eliminate superflous "variadic" local variable.

2 files changed, 22 insertions, 12 deletions

diff --git a/ChangeLog b/ChangeLog
index 733d095d..4d1e89a1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,16 @@
 2015-03-31  Kaz Kylheku  <kaz@kylheku.com>
 
+	Array overrun fix in apply.
+
+	* eval.c (APPLY_ARGS): New preprocessor symbol, replaces
+	hard-coded 32 inside apply.
+	(apply): Use APPLY_ARGS for argument array.
+	Fix overrun of args array in non-variadic function case when
+	list has more than APPLY_ARGS elements.
+	Eliminate superflous "variadic" local variable.
+
+2015-03-31  Kaz Kylheku  <kaz@kylheku.com>
+
 	Deal with spurious retention in function application.
 
 	* gc.h (zap): New inline function.
diff --git a/eval.c b/eval.c
index b7794447..0807f834 100644
--- a/eval.c
+++ b/eval.c
@@ -50,6 +50,8 @@
 #include "combi.h"
 #include "eval.h"
 
+#define APPLY_ARGS 32
+
 typedef val (*opfun_t)(val, val);
 typedef val (*mefun_t)(val, val);
 
@@ -607,8 +609,8 @@ static val get_param_syms(val params)
 
 val apply(val fun, val arglist, val ctx_form)
 {
-  val arg[32], *p = arg;
-  int variadic, fixparam, reqargs, nargs;
+  val arg[APPLY_ARGS], *p = arg;
+  int fixparam, reqargs, nargs;
   val ctx = if3(ctx_form, car(ctx_form), apply_s);
 
   if (fun && symbolp(fun)) {
@@ -620,7 +622,7 @@ val apply(val fun, val arglist, val ctx_form)
 
   if (!functionp(fun)) {
     for (nargs = 0;
-         (p < arg + 32) && consp(arglist);
+         (p < arg + APPLY_ARGS) && consp(arglist);
          nargs++, p++, arglist = cdr(arglist))
     {
       *p = car(arglist);
@@ -638,22 +640,19 @@ val apply(val fun, val arglist, val ctx_form)
     arglist = arglist_conv;
   }
 
-  variadic = fun->f.variadic;
   fixparam = fun->f.fixparam;
   reqargs = fixparam - fun->f.optargs;
 
-  if (!variadic) {
-    for (; arglist; arglist = cdr(arglist))
+  if (!fun->f.variadic) {
+    for (; arglist && p < arg + APPLY_ARGS; arglist = cdr(arglist))
       *p++ = car(arglist);
 
-    nargs = p - arg;
-
-    if (nargs < reqargs)
-      eval_error(ctx_form, lit("~s: missing required arguments"),
+    if (arglist)
+      eval_error(ctx_form, lit("~s: too many arguments"),
                  ctx, nao);
 
-    if (nargs > fixparam)
-      eval_error(ctx_form, lit("~s: too many arguments"),
+    if ((nargs = p - arg) < reqargs)
+      eval_error(ctx_form, lit("~s: missing required arguments"),
                  ctx, nao);
 
     for (; nargs < fixparam; nargs++)