From: Hirohito Higashi <h.east.727@gmail.com>
Date: Fri, 17 Jul 2026 14:52:07 +0000 (+0000)
Subject: patch 9.2.0784: crash when borrowing statusline highlight in silent Ex mode
X-Git-Tag: v9.2.0784^0
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=27e560c68ccb6174805a358db55e1eaf555c1dd1;p=thirdparty%2Fvim.git

patch 9.2.0784: crash when borrowing statusline highlight in silent Ex mode

Problem:  Vim crashes with a NULL pointer dereference when a status line is
          redrawn next to a vertical separator in silent Ex mode, where the
          screen cell arrays are not allocated (tdjackey).
Solution: Skip borrowing the vertical separator highlight when the screen is
          not allocated (Hirohito Higashi).

closes: #20776

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
---

diff --git a/src/drawscreen.c b/src/drawscreen.c
index be5f77a538..65d6a88d31 100644
--- a/src/drawscreen.c
+++ b/src/drawscreen.c
@@ -657,7 +657,9 @@ borrow_stl_vsep_hl(void)
     win_T   *left = NULL;
     win_T   *right = NULL;
 
-    if (!redrawing())
+    // In silent Ex mode the screen is not allocated, so LineOffset and
+    // ScreenAttrs are NULL; there is nothing to borrow.
+    if (!redrawing() || ScreenLines == NULL)
 	return;
 
     FOR_ALL_WINDOWS(left)
diff --git a/src/testdir/crash/poc_borrow_stl_vsep_hl b/src/testdir/crash/poc_borrow_stl_vsep_hl
new file mode 100644
index 0000000000..136b700c9f
--- /dev/null
+++ b/src/testdir/crash/poc_borrow_stl_vsep_hl
@@ -0,0 +1,2 @@
+vnew
+o x
diff --git a/src/testdir/test_crash.vim b/src/testdir/test_crash.vim
index 9b673e4e2a..2a970a3c31 100644
--- a/src/testdir/test_crash.vim
+++ b/src/testdir/test_crash.vim
@@ -83,6 +83,11 @@ func Test_crash1()
   call delete('Xerr')
   call delete('@')
 
+  let file = 'crash/poc_borrow_stl_vsep_hl'
+  let args = printf(cmn_args, vim, file)
+  call s:RunCommandAndWait(buf, args ..
+    \ '  && echo "crash 11: [OK]" >> X_crash1_result.txt')
+
   " clean up
   exe buf .. "bw!"
 
@@ -99,6 +104,7 @@ func Test_crash1()
       \ 'crash 8: [OK]',
       \ 'crash 9: [OK]',
       \ 'crash 10: [OK]',
+      \ 'crash 11: [OK]',
       \ ]
 
   call assert_equal(expected, getline(1, '$'))
diff --git a/src/version.c b/src/version.c
index e3b6bdf836..5d0425b3f7 100644
--- a/src/version.c
+++ b/src/version.c
@@ -759,6 +759,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    784,
 /**/
     783,
 /**/