From 484430baff1c666c7bf4bed30bab6dc3a90a1e23 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Henrik=20Grubbstr=C3=B6m=20=28Grubba=29?= <grubba@grubba.org> Date: Mon, 5 Dec 2016 16:22:49 +0100 Subject: [PATCH] Runtime: Fixed multiple argument checking bugs in ::`->() et al. The new-style argument checks were broken in several places. --- src/object.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/src/object.c b/src/object.c index d9017aeda6..eb6b5ecc7e 100644 --- a/src/object.c +++ b/src/object.c @@ -2726,7 +2726,7 @@ static void f_magic_index(INT32 args) default: case 3: if (TYPEOF(sp[2-args]) != T_INT) - SIMPLE_BAD_ARG_ERROR ("::`->", 2, "void|int"); + SIMPLE_BAD_ARG_ERROR ("::`->", 3, "void|int"); type = sp[2-args].u.integer & 1; /* FALL THROUGH */ case 2: @@ -2948,7 +2948,7 @@ static void f_magic_indices (INT32 args) case 2: if (TYPEOF(sp[1-args]) != T_INT) SIMPLE_BAD_ARG_ERROR ("::_indices", 2, "void|int"); - type = sp[-args].u.integer; + type = sp[1-args].u.integer; /* FALL THROUGH */ case 1: if (TYPEOF(sp[-args]) == T_INT) { @@ -2961,13 +2961,13 @@ static void f_magic_indices (INT32 args) Pike_error("Object is destructed.\n"); inherit = obj->prog->inherits + 0; } - } else if (TYPEOF(sp[2-args]) == T_OBJECT) { - obj = sp[2-args].u.object; + } else if (TYPEOF(sp[-args]) == T_OBJECT) { + obj = sp[-args].u.object; if (obj != MAGIC_THIS->o) Pike_error("::_indices context is not the current object.\n"); if(!obj->prog) Pike_error("::_indices on destructed object.\n"); - inherit = obj->prog->inherits + SUBTYPEOF(sp[2-args]); + inherit = obj->prog->inherits + SUBTYPEOF(sp[-args]); } else { SIMPLE_BAD_ARG_ERROR ("::_indices", 1, "void|object|int"); } @@ -3058,7 +3058,7 @@ static void f_magic_values (INT32 args) case 2: if (TYPEOF(sp[1-args]) != T_INT) SIMPLE_BAD_ARG_ERROR ("::_indices", 2, "void|int"); - type = sp[-args].u.integer; + type = sp[1-args].u.integer; /* FALL THROUGH */ case 1: if (TYPEOF(sp[-args]) == T_INT) { @@ -3071,13 +3071,13 @@ static void f_magic_values (INT32 args) Pike_error("Object is destructed.\n"); inherit = obj->prog->inherits + 0; } - } else if (TYPEOF(sp[2-args]) == T_OBJECT) { - obj = sp[2-args].u.object; + } else if (TYPEOF(sp[-args]) == T_OBJECT) { + obj = sp[-args].u.object; if (obj != MAGIC_THIS->o) Pike_error("::_values context is not the current object.\n"); if(!obj->prog) Pike_error("::_values on destructed object.\n"); - inherit = obj->prog->inherits + SUBTYPEOF(sp[2-args]); + inherit = obj->prog->inherits + SUBTYPEOF(sp[-args]); } else { SIMPLE_BAD_ARG_ERROR ("::_values", 1, "void|object|int"); } @@ -3171,7 +3171,7 @@ static void f_magic_types (INT32 args) case 2: if (TYPEOF(sp[1-args]) != T_INT) SIMPLE_BAD_ARG_ERROR ("::_types", 2, "void|int"); - type = sp[-args].u.integer; + type = sp[1-args].u.integer; /* FALL THROUGH */ case 1: if (TYPEOF(sp[-args]) == T_INT) { @@ -3184,13 +3184,13 @@ static void f_magic_types (INT32 args) Pike_error("Object is destructed.\n"); inherit = obj->prog->inherits + 0; } - } else if (TYPEOF(sp[2-args]) == T_OBJECT) { - obj = sp[2-args].u.object; + } else if (TYPEOF(sp[-args]) == T_OBJECT) { + obj = sp[-args].u.object; if (obj != MAGIC_THIS->o) Pike_error("::_types context is not the current object.\n"); if(!obj->prog) Pike_error("::_types on destructed object.\n"); - inherit = obj->prog->inherits + SUBTYPEOF(sp[2-args]); + inherit = obj->prog->inherits + SUBTYPEOF(sp[-args]); } else { SIMPLE_BAD_ARG_ERROR ("::_types", 1, "void|object|int"); } -- GitLab