Fix a segfault when auto-calling a "a@{...}" function

Since the called function can return its argument attribute set
(e.g. "a"), the latter should not be allocated on the stack.

Reported by Shea.

1 files changed, 5 insertions, 5 deletions

diff --git a/src/libexpr/eval.cc b/src/libexpr/eval.cc
index 2f9601ec550f..b176bbc82497 100644
--- a/src/libexpr/eval.cc
+++ b/src/libexpr/eval.cc
@@ -790,20 +790,20 @@ void EvalState::autoCallFunction(Bindings & args, Value & fun, Value & res)
         return;
     }
 
-    Value actualArgs;
-    mkAttrs(actualArgs, fun.lambda.fun->formals->formals.size());
+    Value * actualArgs = allocValue();
+    mkAttrs(*actualArgs, fun.lambda.fun->formals->formals.size());
 
     foreach (Formals::Formals_::iterator, i, fun.lambda.fun->formals->formals) {
         Bindings::iterator j = args.find(i->name);
         if (j != args.end())
-            actualArgs.attrs->push_back(*j);
+            actualArgs->attrs->push_back(*j);
         else if (!i->def)
             throwTypeError("cannot auto-call a function that has an argument without a default value (`%1%')", i->name);
     }
 
-    actualArgs.attrs->sort();
+    actualArgs->attrs->sort();
 
-    callFunction(fun, actualArgs, res);
+    callFunction(fun, *actualArgs, res);
 }