patch 9.2.0784: crash when borrowing statusline highlight in silent Ex mode

Problem:  Vim crashes with a NULL pointer dereference when a status line is
          redrawn next to a vertical separator in silent Ex mode, where the
          screen cell arrays are not allocated (tdjackey).
Solution: Skip borrowing the vertical separator highlight when the screen is
          not allocated (Hirohito Higashi).

closes: #20776

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/drawscreen.c b/src/drawscreen.c
index be5f77a5388aaecfe3c6f7955a7156fb5ef2c73d..65d6a88d31b3bf623caca44d1fc8881b0bdaccf2 100644 (file)
--- a/src/drawscreen.c
+++ b/src/drawscreen.c
@@ -657,7 +657,9 @@ borrow_stl_vsep_hl(void)
     win_T   *left = NULL;
     win_T   *right = NULL;
 
-    if (!redrawing())
+    // In silent Ex mode the screen is not allocated, so LineOffset and
+    // ScreenAttrs are NULL; there is nothing to borrow.
+    if (!redrawing() || ScreenLines == NULL)
        return;
 
     FOR_ALL_WINDOWS(left)

diff --git a/src/testdir/crash/poc_borrow_stl_vsep_hl b/src/testdir/crash/poc_borrow_stl_vsep_hl
new file mode 100644 (file)
index 0000000..136b700
--- /dev/null
+++ b/src/testdir/crash/poc_borrow_stl_vsep_hl
@@ -0,0 +1,2 @@
+vnew
+o x

diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
index 9b673e4e2a91dfbea0d2473b249921d3fc31319b..2a970a3c31012a95e22bc3f4800a908e613a35b7 100644 (file)
--- a/src/testdir/test_crash.vim
+++ b/src/testdir/test_crash.vim
@@ -83,6 +83,11 @@ func Test_crash1()
   call delete('Xerr')
   call delete('@')
 
+  let file = 'crash/poc_borrow_stl_vsep_hl'
+  let args = printf(cmn_args, vim, file)
+  call s:RunCommandAndWait(buf, args ..
+    \ '  && echo "crash 11: [OK]" >> X_crash1_result.txt')
+
   " clean up
   exe buf .. "bw!"
 
@@ -99,6 +104,7 @@ func Test_crash1()
       \ 'crash 8: [OK]',
       \ 'crash 9: [OK]',
       \ 'crash 10: [OK]',
+      \ 'crash 11: [OK]',
       \ ]
 
   call assert_equal(expected, getline(1, '$'))

diff --git a/src/version.c b/src/version.c
index e3b6bdf83637120511aa100125ca570dc2e03090..5d0425b3f7d1c63ac3b21c66a7f391c80d246cea 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -759,6 +759,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    784,
 /**/
     783,
 /**/