commit e0d749a49630778d45642d7589a3703697746760
author Bram Moolenaar <Bram@vim.org> Wed Sep 25 22:14:48 2019 +0200
committer Bram Moolenaar <Bram@vim.org> Wed Sep 25 22:14:48 2019 +0200
tree 370bd15386bc479491d0aa3f70abeed83038c2ec
parent 101e99207f813ca48a4c0787eed9eb8bf67fba5a

patch 8.1.2076: crash when trying to put a terminal in a popup window

Problem:    Crash when trying to put a terminal buffer in a popup window.
Solution:   Check for NULL buffer.  Do not allow putting a terminal in a popup
            window.

src/libvterm/src/termscreen.c

diff --git a/src/libvterm/src/termscreen.c b/src/libvterm/src/termscreen.c
index c33fb59..6ad0e1a 100644
--- a/src/libvterm/src/termscreen.c
+++ b/src/libvterm/src/termscreen.c
@@ -75,6 +75,8 @@
     return NULL;
   if(col < 0 || col >= screen->cols)
     return NULL;
+  if (screen->buffer == NULL)
+    return NULL;
   return screen->buffer + (screen->cols * row) + col;
 }
 

src/popupwin.c

diff --git a/src/popupwin.c b/src/popupwin.c
index 81cc17f..5425d09 100644
--- a/src/popupwin.c
+++ b/src/popupwin.c
@@ -1638,6 +1638,11 @@
 		semsg(_(e_nobufnr), argvars[0].vval.v_number);
 		return NULL;
 	    }
+	    if (buf->b_term != NULL)
+	    {
+		emsg(_("E278: Cannot put a terminal buffer in a popup window"));
+		return NULL;
+	    }
 	}
 	else if (!(argvars[0].v_type == VAR_STRING
 			&& argvars[0].vval.v_string != NULL)

src/terminal.c

diff --git a/src/terminal.c b/src/terminal.c
index a8b7881..f1d89ab 100644
--- a/src/terminal.c
+++ b/src/terminal.c
@@ -3347,6 +3347,8 @@
 	    newcols = MIN(newcols, twp->w_width);
 	}
     }
+    if (newrows == 99999 || newcols == 99999)
+	return; // safety exit
     newrows = rows == 0 ? newrows : minsize ? MAX(rows, newrows) : rows;
     newcols = cols == 0 ? newcols : minsize ? MAX(cols, newcols) : cols;
 

src/testdir/test_popupwin.vim

diff --git a/src/testdir/test_popupwin.vim b/src/testdir/test_popupwin.vim
index 11e554f..dfdfc13 100644
--- a/src/testdir/test_popupwin.vim
+++ b/src/testdir/test_popupwin.vim
@@ -1992,6 +1992,12 @@
   call delete('XsomeFile')
 endfunc
 
+func Test_popupwin_terminal_buffer()
+  let ptybuf = term_start(&shell, #{hidden: 1})
+  call assert_fails('let winnr = popup_create(ptybuf, #{})', 'E278:')
+  exe 'bwipe! ' .. ptybuf
+endfunc
+
 func Test_popupwin_with_buffer_and_filter()
   new Xwithfilter
   call setline(1, range(100))

src/version.c

diff --git a/src/version.c b/src/version.c
index f1c082b..4bf2106 100644
--- a/src/version.c
+++ b/src/version.c
@@ -758,6 +758,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    2076,
+/**/
     2075,
 /**/
     2074,