patch 8.1.0694: when using text props may free memory that is not allocated

Problem:    When using text props may free memory that is not allocated.
            (Andy Massimino)
Solution:   Allocate the line when adjusting text props. (closes #3766)

diff --git a/src/textprop.c b/src/textprop.c
index 7bc10e080b41f05a0695c99ffb223811d3596db0..8b7d3f15ed8aed230e3f32062eae8c04a09a2361 100644 (file)
--- a/src/textprop.c
+++ b/src/textprop.c
@@ -979,7 +979,9 @@ adjust_prop_columns(
        pt = text_prop_type_by_id(curbuf, tmp_prop.tp_type);
 
        if (bytes_added > 0
-               ? (tmp_prop.tp_col >= col + (pt != NULL && (pt->pt_flags & PT_FLAG_INS_START_INCL) ? 2 : 1))
+               ? (tmp_prop.tp_col >= col
+                      + (pt != NULL && (pt->pt_flags & PT_FLAG_INS_START_INCL)
+                                                                     ? 2 : 1))
                : (tmp_prop.tp_col > col + 1))
        {
            tmp_prop.tp_col += bytes_added;
@@ -987,7 +989,7 @@ adjust_prop_columns(
        }
        else if (tmp_prop.tp_len > 0
                && tmp_prop.tp_col + tmp_prop.tp_len > col
-                       + ((pt != NULL && (pt->pt_flags & PT_FLAG_INS_END_INCL))
+                      + ((pt != NULL && (pt->pt_flags & PT_FLAG_INS_END_INCL))
                                                                      ? 0 : 1))
        {
            tmp_prop.tp_len += bytes_added;
@@ -1001,8 +1003,13 @@ adjust_prop_columns(
     }
     if (dirty)
     {
+       colnr_T newlen = (int)textlen + wi * (colnr_T)sizeof(textprop_T);
+
+       if ((curbuf->b_ml.ml_flags & ML_LINE_DIRTY) == 0)
+           curbuf->b_ml.ml_line_ptr =
+                                vim_memsave(curbuf->b_ml.ml_line_ptr, newlen);
        curbuf->b_ml.ml_flags |= ML_LINE_DIRTY;
-       curbuf->b_ml.ml_line_len = (int)textlen + wi * sizeof(textprop_T);
+       curbuf->b_ml.ml_line_len = newlen;
     }
 }
 

diff --git a/src/version.c b/src/version.c
index 7d3a5f619bb77eb6a2aba0fe1e5e10eda36dd411..3450325e78a48dca1c8ce6cde7c295105eefc187 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -799,6 +799,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    694,
 /**/
     693,
 /**/