patch 8.2.4762: using freed memory using synstack() and synID() in WinEnter

Problem:    Using freed memory when using synstack() and synID() in WinEnter.
Solution:   Check using the syntax window. (closes #10204)

diff --git a/src/syntax.c b/src/syntax.c
index 086d9d755e9eab97f5e72f6e54858aaea57459fb..6b71e8dfabeefda1bdea4a1234aaa3ce9373f288 100644 (file)
--- a/src/syntax.c
+++ b/src/syntax.c
@@ -6486,8 +6486,9 @@ syn_get_id(
     int                keep_state)  // keep state of char at "col"
 {
     // When the position is not after the current position and in the same
-    // line of the same buffer, need to restart parsing.
-    if (wp->w_buffer != syn_buf
+    // line of the same window with the same buffer, need to restart parsing.
+    if (wp != syn_win
+           || wp->w_buffer != syn_buf
            || lnum != current_lnum
            || col < current_col)
        syntax_start(wp, lnum);

diff --git a/src/testdir/test_syntax.vim b/src/testdir/test_syntax.vim
index 14ae4c575ff98e027f04520090cd5beaa73b05f5..be2f458287d8f85a3622b153fdc7a5f436034575 100644 (file)
--- a/src/testdir/test_syntax.vim
+++ b/src/testdir/test_syntax.vim
@@ -956,5 +956,18 @@ func Test_syn_include_contains_TOP()
   bw!
 endfunc
 
+" This was using freed memory
+func Test_WinEnter_synstack_synID()
+  autocmd WinEnter * call synstack(line("."), col("."))
+  autocmd WinEnter * call synID(line('.'), col('.') - 1, 1)
+  call setline(1, 'aaaaa')
+  normal! $
+  new
+  close
+
+  au! WinEnter
+  bw!
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index 19391268ff64b7db0680d6f570ff1767e5ac303c..1cc0d906b13414d0bad8019923cc740113bad5f7 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -746,6 +746,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    4762,
 /**/
     4761,
 /**/