patch 8.1.1395: saving for undo may access invalid memory

Problem:    Saving for undo may access invalid memory. (Dominique Pelle)
Solution:   Set ml_line_len also when returning a constant string.

diff --git a/src/memline.c b/src/memline.c
index 35b524e6b21d439544ef12f2eee3fa7317b3a935..8416257162d55d4afc42e39e281f50aff3f71611 100644 (file)
--- a/src/memline.c
+++ b/src/memline.c
@@ -2573,13 +2573,17 @@ ml_get_buf(
        }
 errorret:
        STRCPY(IObuff, "???");
+       buf->b_ml.ml_line_len = 4;
        return IObuff;
     }
-    if (lnum <= 0)                     /* pretend line 0 is line 1 */
+    if (lnum <= 0)                     // pretend line 0 is line 1
        lnum = 1;
 
-    if (buf->b_ml.ml_mfp == NULL)      /* there are no lines */
+    if (buf->b_ml.ml_mfp == NULL)      // there are no lines
+    {
+       buf->b_ml.ml_line_len = 1;
        return (char_u *)"";
+    }
 
     /*
      * See if it is the same line as requested last time.

diff --git a/src/testdir/test_textprop.vim b/src/testdir/test_textprop.vim
index 811ddf4d17ee635a0fc78c90dd7f137a419954df..cb86186b4b7b79fa6bd18cb230172d2bd92be582 100644 (file)
--- a/src/testdir/test_textprop.vim
+++ b/src/testdir/test_textprop.vim
@@ -766,6 +766,15 @@ func Test_textprop_empty_buffer()
   new
   call prop_add(1, 1, {'type': 'comment'})
   close
+  call prop_type_delete('comment')
+endfunc
+
+" Adding a text property to an empty buffer and then editing another
+func Test_textprop_empty_buffer_next()
+  call prop_type_add("xxx", {})
+  call prop_add(1, 1, {"type": "xxx"})
+  next X
+  call prop_type_delete('xxx')
 endfunc
 
 func Test_textprop_remove_from_buf()

diff --git a/src/version.c b/src/version.c
index 2d4c3c01dcf4a660b45cdf029d3f9a95ce57791e..3dad141283b9ddd72f9d190f1962e5c255fabfd9 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -767,6 +767,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1395,
 /**/
     1394,
 /**/