changeset 16786:98ca522e6453 v8.1.1395

patch 8.1.1395: saving for undo may access invalid memory commit https://github.com/vim/vim/commit/adfde115d5c9c9ac4a052874bcf85d2507fe1355 Author: Bram Moolenaar <Bram@vim.org> Date: Sat May 25 22:11:45 2019 +0200 patch 8.1.1395: saving for undo may access invalid memory Problem: Saving for undo may access invalid memory. (Dominique Pelle) Solution: Set ml_line_len also when returning a constant string.
author Bram Moolenaar <Bram@vim.org>
date Sat, 25 May 2019 22:15:04 +0200
parents 27616b16dc88
children 7cde4330b0cb
files src/memline.c src/testdir/test_textprop.vim src/version.c
diffstat 3 files changed, 17 insertions(+), 2 deletions(-) [+]
line wrap: on
line diff
--- a/src/memline.c
+++ b/src/memline.c
@@ -2573,13 +2573,17 @@ ml_get_buf(
 	}
 errorret:
 	STRCPY(IObuff, "???");
+	buf->b_ml.ml_line_len = 4;
 	return IObuff;
     }
-    if (lnum <= 0)			/* pretend line 0 is line 1 */
+    if (lnum <= 0)			// pretend line 0 is line 1
 	lnum = 1;
 
-    if (buf->b_ml.ml_mfp == NULL)	/* there are no lines */
+    if (buf->b_ml.ml_mfp == NULL)	// there are no lines
+    {
+	buf->b_ml.ml_line_len = 1;
 	return (char_u *)"";
+    }
 
     /*
      * See if it is the same line as requested last time.
--- a/src/testdir/test_textprop.vim
+++ b/src/testdir/test_textprop.vim
@@ -766,6 +766,15 @@ func Test_textprop_empty_buffer()
   new
   call prop_add(1, 1, {'type': 'comment'})
   close
+  call prop_type_delete('comment')
+endfunc
+
+" Adding a text property to an empty buffer and then editing another
+func Test_textprop_empty_buffer_next()
+  call prop_type_add("xxx", {})
+  call prop_add(1, 1, {"type": "xxx"})
+  next X
+  call prop_type_delete('xxx')
 endfunc
 
 func Test_textprop_remove_from_buf()
--- a/src/version.c
+++ b/src/version.c
@@ -768,6 +768,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1395,
+/**/
     1394,
 /**/
     1393,