diff -up vim82/src/errors.h.cve1420 vim82/src/errors.h --- vim82/src/errors.h.cve1420 2022-04-25 16:01:03.559985019 +0200 +++ vim82/src/errors.h 2022-04-25 16:01:58.113332024 +0200 @@ -383,3 +383,7 @@ EXTERN char e_cannot_use_default_values_ INIT(= N_("E1172: Cannot use default values in a lambda")); EXTERN char e_resulting_text_too_long[] INIT(= N_("E1240: Resulting text too long")); +#ifdef FEAT_EVAL +EXTERN char e_string_or_function_required_for_arrow_parens_expr[] + INIT(= N_("E1275: String or function required for ->(expr)")); +#endif diff -up vim82/src/eval.c.cve1420 vim82/src/eval.c --- vim82/src/eval.c.cve1420 2022-04-25 16:01:03.560985007 +0200 +++ vim82/src/eval.c 2022-04-25 16:14:11.746600369 +0200 @@ -3718,13 +3718,20 @@ eval_lambda( if (**arg != ')') { emsg(_(e_missing_close)); - ret = FAIL; + return FAIL; + } + if (rettv->v_type != VAR_STRING && rettv->v_type != VAR_FUNC + && rettv->v_type != VAR_PARTIAL) + { + emsg(_(e_string_or_function_required_for_arrow_parens_expr)); + return FAIL; } ++*arg; } if (ret != OK) return FAIL; - else if (**arg != '(') + + if (**arg != '(') { if (verbose) { diff -up vim82/src/testdir/test_lambda.vim.cve1420 vim82/src/testdir/test_lambda.vim --- vim82/src/testdir/test_lambda.vim.cve1420 2022-04-25 16:01:03.560985007 +0200 +++ vim82/src/testdir/test_lambda.vim 2022-04-25 16:17:01.694886566 +0200 @@ -64,6 +64,10 @@ function Test_lambda_fails() call assert_fails('echo {a, a -> a + a}(1, 2)', 'E853:') call assert_fails('echo {a, b -> a + b)}(1, 2)', 'E451:') echo assert_fails('echo 10->{a -> a + 2}', 'E107:') + call assert_fails('eval 0->(3)()', "E1275:") + call assert_fails('eval 0->([3])()', "E1275:") + call assert_fails('eval 0->({"a": 3})()', "E1275:") + call assert_fails('eval 0->(xxx)()', "E121:") endfunc func Test_not_lamda()