APPEND to object of block of odd length can crash

[rebolbot]

Submitted by: Sunanda

REBOL System Error 1305; invalid data type 83

append make object! [] reduce [a: 'x]

^{CC – Data [ Version: alpha 47 Type: Bug Platform: All Category: n/a Reproduce: Always Fixed-in:alpha 49 ]}

[rebolbot]

Submitted by: BrianH

This is what I get when I enter your code in a fresh console:

>> append make object! [] reduce [a: 'x]
*\* Script error: invalid argument: frame!
*\* Where: append
*\* Near: append make object! [] [x]

This is the wrong error – there is no frame! in that statement.

On a hunch I next try:

>> append make object! [] [x y z]

…and I get your crash error. This indicates that there is a bounds checking problem when you append a block with an odd number of values in it to an object.

APPEND to an object is supposed to add unset! when just a word! is appended, like this:

>> append make object! [] ’a == make object! [ a: unset! ]

Clearly when the value portion is missing from APPEND of [name value], it just tries to use whatever is next in memory instead of assigning unset!. Depending on what is next in memory, that could crash the system or render it corrupt.

Upped the severity and priority accordingly.

[Oldes]

This bug seems to be fixed, although there is different result when using block with word without value, or when used just a word:

>> append make object! [] [x]
== make object! [
    x: none
]

>> append make object! [] 'x
== make object! [
    x: unset!
]

I think that the result should be same... so having none! in the second case too.