commit ab9f2ecfd4ecaf74eeed0e5ec41355589af3ec8f
author zeertzjq <zeertzjq@outlook.com> Sun Aug 20 18:35:10 2023 +0200
committer Christian Brabandt <cb@256bit.org> Sun Aug 20 18:41:42 2023 +0200
tree 69b60a7f93070e086eab544964c59d0de6b6bd61
parent f9037f186ad45b56c84f1efdc131480bec159e4f

patch 9.0.1763: crash when passing invalid buffer to undotree()

Problem:  crash when passing invalid buffer to undotree()
Solution: Use get_buf_arg() instead of tv_get_buf_from_arg().

closes: #12862
closes: #12830

Signed-off-by: Christian Brabandt <cb@256bit.org>
Co-authored-by: zeertzjq <zeertzjq@outlook.com>

src/undo.c

diff --git a/src/undo.c b/src/undo.c
index 85c4670..b2c4e9a 100644
--- a/src/undo.c
+++ b/src/undo.c
@@ -3726,23 +3726,18 @@
     void
 f_undotree(typval_T *argvars UNUSED, typval_T *rettv)
 {
-    typval_T	*tv = &argvars[0];
-    buf_T	*buf;
-    dict_T	*dict;
-    list_T	*list;
-
     if (in_vim9script() && check_for_opt_buffer_arg(argvars, 0) == FAIL)
 	return;
 
-    if (tv->v_type == VAR_UNKNOWN)
-	buf = curbuf;
-    else
-	buf = tv_get_buf_from_arg(tv);
-
     if (rettv_dict_alloc(rettv) == FAIL)
 	return;
 
-    dict = rettv->vval.v_dict;
+    typval_T	*tv = &argvars[0];
+    buf_T	*buf = tv->v_type == VAR_UNKNOWN ? curbuf : get_buf_arg(tv);
+    if (buf == NULL)
+	return;
+
+    dict_T *dict = rettv->vval.v_dict;
 
     dict_add_number(dict, "synced", (long)buf->b_u_synced);
     dict_add_number(dict, "seq_last", buf->b_u_seq_last);
@@ -3751,7 +3746,7 @@
     dict_add_number(dict, "time_cur", (long)buf->b_u_time_cur);
     dict_add_number(dict, "save_cur", buf->b_u_save_nr_cur);
 
-    list = list_alloc();
+    list_T *list = list_alloc();
     if (list != NULL)
     {
 	u_eval_tree(buf, buf->b_u_oldhead, list);