*fixed segfault (affects all flavors) where creating an expr object with more...

*fixed segfault (affects all flavors) where creating an expr object with more than MAX_VARS variables (currently set to 9) crashed pd when freeing the object. Example: create [expr 1;2;3;4;5;6;7;8;9;10] as opposed to [expr 1;2;3;4;5;6;7;8;9]. Former crashes when being freed (destroyed), while latter doesn't.

pd/extra/expr~/vexp.c

@@ -265,6 +265,11 @@ expr_donew(struct expr *expr, int ac, t_atom *av)
                   (struct ex_ex *)fts_malloc(max_node * sizeof (struct ex_ex));
                 expr->exp_nexpr++;
                 ret = ex_match(list, (long)0);
+                if (expr->exp_nexpr > MAX_VARS) // we cannot exceed the number of max vars (arbitrarily set to 9 in vexp.h)
+                {
+                        post_error((fts_object_t *) expr, "expr: too many variables (maximum %d allowed)", MAX_VARS);
+                        goto error;   
+                }
                 if (!ret)               /* syntax error */
                         goto error;
                 ret = ex_parse(expr,