patch 8.2.1848: crash when passing a NULL string or list to popup_settext()

Problem:    Crashyyyyy passing a NULL string or list to popup_settext().
Solution:   Check for NULL pointers. (closes #7132)

diff --git a/src/popupwin.c b/src/popupwin.c
index 05db1af631374f8505b1ab1dc77ee63cfaf0fa99..777e7d84b18b1ac6df7a3673b4fc538046f6ce6a 100644 (file)
--- a/src/popupwin.c
+++ b/src/popupwin.c
@@ -1595,14 +1595,16 @@ popup_set_buffer_text(buf_T *buf, typval_T text)
     // Add text to the buffer.
     if (text.v_type == VAR_STRING)
     {
+       char_u *s = text.vval.v_string;
+
        // just a string
-       ml_append_buf(buf, 0, text.vval.v_string, (colnr_T)0, TRUE);
+       ml_append_buf(buf, 0, s == NULL ? (char_u *)"" : s, (colnr_T)0, TRUE);
     }
     else
     {
        list_T *l = text.vval.v_list;
 
-       if (l->lv_len > 0)
+       if (l != NULL && l->lv_len > 0)
        {
            if (l->lv_first->li_tv.v_type == VAR_STRING)
                // list of strings

diff --git a/src/testdir/test_popupwin.vim b/src/testdir/test_popupwin.vim
index 187b4f13eb213f56c6c974a1acc705602a91b455..1524e7856321105869c5f9c4cef763e1fd439855 100644 (file)
--- a/src/testdir/test_popupwin.vim
+++ b/src/testdir/test_popupwin.vim
@@ -2363,6 +2363,16 @@ func Test_popup_settext_getline()
   call popup_close(id)
 endfunc
 
+func Test_popup_settext_null()
+  let id = popup_create('', #{ tabpage: 0 })
+  call popup_settext(id, test_null_list())
+  call popup_close(id)
+
+  let id = popup_create('', #{ tabpage: 0 })
+  call popup_settext(id, test_null_string())
+  call popup_close(id)
+endfunc
+
 func Test_popup_hidden()
   new
 

diff --git a/src/version.c b/src/version.c
index b95e0e99217675f499eb574be9ee922359409244..b0fe5e8e1583b15dfef75b2af42d87fd2d141eed 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1848,
 /**/
     1847,
 /**/