patch 8.1.1395: saving for undo may access invalid memory
Problem: Saving for undo may access invalid memory. (Dominique Pelle)
Solution: Set ml_line_len also when returning a constant string.
diff --git a/src/memline.c b/src/memline.c
index 35b524e..8416257 100644
--- a/src/memline.c
+++ b/src/memline.c
@@ -2573,13 +2573,17 @@
}
errorret:
STRCPY(IObuff, "???");
+ buf->b_ml.ml_line_len = 4;
return IObuff;
}
- if (lnum <= 0) /* pretend line 0 is line 1 */
+ if (lnum <= 0) // pretend line 0 is line 1
lnum = 1;
- if (buf->b_ml.ml_mfp == NULL) /* there are no lines */
+ if (buf->b_ml.ml_mfp == NULL) // there are no lines
+ {
+ buf->b_ml.ml_line_len = 1;
return (char_u *)"";
+ }
/*
* See if it is the same line as requested last time.
diff --git a/src/testdir/test_textprop.vim b/src/testdir/test_textprop.vim
index 811ddf4..cb86186 100644
--- a/src/testdir/test_textprop.vim
+++ b/src/testdir/test_textprop.vim
@@ -766,6 +766,15 @@
new
call prop_add(1, 1, {'type': 'comment'})
close
+ call prop_type_delete('comment')
+endfunc
+
+" Adding a text property to an empty buffer and then editing another
+func Test_textprop_empty_buffer_next()
+ call prop_type_add("xxx", {})
+ call prop_add(1, 1, {"type": "xxx"})
+ next X
+ call prop_type_delete('xxx')
endfunc
func Test_textprop_remove_from_buf()
diff --git a/src/version.c b/src/version.c
index 2d4c3c0..3dad141 100644
--- a/src/version.c
+++ b/src/version.c
@@ -768,6 +768,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 1395,
+/**/
1394,
/**/
1393,