gs: fix missing type check in ztype (thanks jsmoody)

to reproduce:

gs <<.
null [[][][][][][][][][][][][][][][]] .type
.

1 files changed, 13 insertions, 8 deletions

diff --git a/sys/src/cmd/gs/src/ztype.c b/sys/src/cmd/gs/src/ztype.c
index 7b87f7437..fb1ef110a 100644
--- a/sys/src/cmd/gs/src/ztype.c
+++ b/sys/src/cmd/gs/src/ztype.c
@@ -77,14 +77,15 @@ ztype(i_ctx_t *i_ctx_p)
 	/* Must be either a stack underflow or a t_[a]struct. */
 	check_op(2);
 	{			/* Get the type name from the structure. */
-	    const char *sname =
-		gs_struct_type_name_string(gs_object_type(imemory,
-							  op[-1].value.pstruct));
-	    int code = name_ref(imemory, (const byte *)sname, strlen(sname),
-				(ref *) (op - 1), 0);
-
-	    if (code < 0)
-		return code;
+	    if ((r_has_type(&op[-1], t_struct) || r_has_type(&op[-1], t_astruct))
+	    && op[-1].value.pstruct != 0x00) {
+		const char *sname =
+		    gs_struct_type_name_string(gs_object_type(imemory, op[-1].value.pstruct));
+		code = name_ref(imemory, (const byte *)sname, strlen(sname), (ref *) (op - 1), 0);
+		if (code < 0)
+		    return code;
+	    } else
+		return_error(e_stackunderflow);
 	}
 	r_set_attrs(op - 1, a_executable);
     } else {
@@ -350,6 +351,8 @@ zcvrs(i_ctx_t *i_ctx_p)
 		    pop(2);
 		    return 0;
 		}
+	    case t__invalid:
+		return_error(e_stackunderflow);
 	    default:
 		return_op_typecheck(op - 2);
 	}
@@ -371,6 +374,8 @@ zcvrs(i_ctx_t *i_ctx_p)
 			return_error(e_rangecheck);
 		    ival = (ulong) (long)fval;
 		} break;
+	    case t__invalid:
+		return_error(e_stackunderflow);
 	    default:
 		return_op_typecheck(op - 2);
 	}