APPEND to object of block of odd length can crash

[Siskin-Bot]

Submitted by: Sunanda

REBOL System Error 1305; invalid data type 83

append make object! [] reduce [a: 'x]

---

^{Imported from: CureCode [ Version: alpha 47 Type: Bug Platform: All Category: n/a Reproduce: Always Fixed-in:alpha 49 ]
Imported from: metaeducation#708}

Comments:

Rebolbot commented on Apr 11, 2009:

Submitted by: BrianH

This is what I get when I enter your code in a fresh console:

bc.. >> append make object! [] reduce [a: 'x]
** Script error: invalid argument: frame!
** Where: append
** Near: append make object! [] [x]

p.

This is the wrong error - there is no frame! in that statement.

On a hunch I next try:

>> append make object! [] [x y z]

...and I get your crash error. This indicates that there is a bounds checking problem when you append a block with an odd number of values in it to an object.

APPEND to an object is supposed to add unset! when just a word! is appended, like this:

>> append make object! [] 'a
== make object! [
    a: unset!
]

Clearly when the value portion is missing from APPEND of [name value], it just tries to use whatever is next in memory instead of assigning unset!. Depending on what is next in memory, that could crash the system or render it corrupt.

Upped the severity and priority accordingly.

---

Rebolbot added Type.bug and Status.important on Jan 12, 2016

---

Oldes commented on Feb 9, 2020:

This bug seems to be fixed, although there is different result when using block with word without value, or when used just a word:

>> append make object! [] [x]
== make object! [
    x: none
]

>> append make object! [] 'x
== make object! [
    x: unset!
]

I think that the result should be same... so having none! in the second case too.

---

Oldes added a commit to Oldes/Rebol3 that referenced this issue on Feb 9, 2020:
FIX: APPEND a word on object should set the value to NONE instead of …

---

Hostilefork added the Ren.important on Feb 9, 2020

---

[Oldes]

When testing #1107 I realized, that both values should be unset! and not none! as I did.

[Oldes]

Now it is:

>> append make object! [] [x]
== make object! [
    x: unset!
]

>> append make object! [] 'x
== make object! [
    x: unset!
]