commit f1cc4d55b9ed3335985512fb9fedf31cc4bb65a0
author Christian Brabandt <cb@256bit.org> Sat Aug 12 00:14:14 2023 +0200
committer Christian Brabandt <cb@256bit.org> Sat Aug 12 00:14:14 2023 +0200
tree f4a8ee4f08590701d5a3aaa563028e795f52405c
parent bacc83009bc38c9ba0247aaa22b76d1993d57993

patch 9.0.1695: Crash with overlong textprop above

Problem: Crash with overlong textprop above
Solution: Consider only positive padding

closes: #12665
closes: #12661

Signed-off-by: Christian Brabandt <cb@256bit.org>

src/drawline.c

diff --git a/src/drawline.c b/src/drawline.c
index 0638c56..9d6ee8d 100644
--- a/src/drawline.c
+++ b/src/drawline.c
@@ -721,7 +721,7 @@
 
 	// add 1 for NUL, 2 for when '…' is used
 	if (n_attr != NULL)
-	    l = alloc(n_used + before + after + padding + 3);
+	    l = alloc(n_used + before + after + (padding > 0 ? padding : 0) + 3);
 	if (n_attr == NULL || l != NULL)
 	{
 	    int off = 0;
@@ -801,7 +801,7 @@
 
 		// n_attr_skip will not be decremented before draw_state is
 		// WL_LINE
-		*n_attr_skip = before + padding;
+		*n_attr_skip = before + (padding > 0 ? padding : 0);
 	    }
 	}
     }

src/testdir/dumps/Test_prop_long_above_1.dump

diff --git a/src/testdir/dumps/Test_prop_long_above_1.dump b/src/testdir/dumps/Test_prop_long_above_1.dump
new file mode 100644
index 0000000..f8db396
--- /dev/null
+++ b/src/testdir/dumps/Test_prop_long_above_1.dump
@@ -0,0 +1,8 @@
+|t+0#ffffff16#ff404010|h|e| |q|u|i|c|k| |b|r|o|w|n| |f|o|x| |j|u|m|p|s| |o|v|e|r| |t|h|e| |l|a|z|y| |d|o|g|.| |t|h|e| |q|u|i|c|k| |b|r|o|w|n
+>x+0#0000000#ffffff0@2| @56
+|y@2| @56
+|~+0#4040ff13&| @58
+|~| @58
+|~| @58
+|~| @58
+| +0#0000000&@41|1|,|1|-|6|1| @7|A|l@1| 

src/testdir/test_textprop.vim

diff --git a/src/testdir/test_textprop.vim b/src/testdir/test_textprop.vim
index 550a0e5..67547f0 100644
--- a/src/testdir/test_textprop.vim
+++ b/src/testdir/test_textprop.vim
@@ -3951,5 +3951,24 @@
   call StopVimInTerminal(buf)
 endfunc
 
+func Test_overlong_textprop_above_crash()
+  CheckRunVimInTerminal
 
+  let lines =<< trim END
+  vim9script
+  prop_type_add('PropType', {highlight: 'Error'})
+  setline(1, ['xxx ', 'yyy'])
+  prop_add(1, 0, {
+      type: 'PropType',
+      text: 'the quick brown fox jumps over the lazy dog. the quick brown fox jumps over the lazy dog. the quick brown fox jumps over the lazy dog.',
+      text_align: 'above',
+      text_wrap: 'wrap',
+  })
+  END
+  call writefile(lines, 'XtextPropLongAbove', 'D')
+  let buf = RunVimInTerminal('-S XtextPropLongAbove', #{rows: 8, cols: 60})
+  call VerifyScreenDump(buf, 'Test_prop_long_above_1', {})
+
+  call StopVimInTerminal(buf)
+endfunc
 " vim: shiftwidth=2 sts=2 expandtab

src/version.c

diff --git a/src/version.c b/src/version.c
index b612dc7..57830dd 100644
--- a/src/version.c
+++ b/src/version.c
@@ -696,6 +696,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1695,
+/**/
     1694,
 /**/
     1693,