patch 8.2.1259: empty group in 'tabline' may cause using an invalid pointer

Problem:    Empty group in 'tabline' may cause using an invalid pointer.
Solution:   Set the group start position. (closes #6505)

diff --git a/src/buffer.c b/src/buffer.c
index 40ca25dfa52042bfe784efd2c1120c30f1a98957..54afb13b08b6f4ce821670fcdb493140fc145d5f 100644 (file)
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -4229,12 +4229,19 @@ build_stl_str_hl(
                }
                if (n == curitem && group_start_userhl == group_end_userhl)
                {
+                   // empty group
                    p = t;
                    l = 0;
-                   // do not use the highlighting from the removed group
                    for (n = groupitem[groupdepth] + 1; n < curitem; n++)
+                   {
+                       // do not use the highlighting from the removed group
                        if (item[n].type == Highlight)
                            item[n].type = Empty;
+                       // adjust the start position of TabPage to the next
+                       // item position
+                       if (item[n].type == TabPage)
+                           item[n].start = p;
+                   }
                }
            }
            if (l > item[groupitem[groupdepth]].maxwid)

diff --git a/src/testdir/test_tabline.vim b/src/testdir/test_tabline.vim
index eff95082cc57a14bfcd86f461620d006e79976de..6cfed7d1667510696bc98a396efc94fbfcb31ba5 100644 (file)
--- a/src/testdir/test_tabline.vim
+++ b/src/testdir/test_tabline.vim
@@ -112,4 +112,27 @@ func Test_tabline_flags()
   %bw!
 endfunc
 
+function EmptyTabname()
+  return ""
+endfunction
+
+function MakeTabLine() abort
+  let titles = map(range(1, tabpagenr('$')), '"%( %" . v:val . "T%{EmptyTabname()}%T %)"')
+  let sep = 'あ'
+  let tabpages = join(titles, sep)
+  return tabpages .. sep .. '%=%999X X'
+endfunction
+
+func Test_tabline_empty_group()
+  " this was reading invalid memory
+  set tabline=%!MakeTabLine()
+  tabnew
+  redraw!
+
+  tabclose
+  set tabline=
+endfunc
+
+
+
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index 1aacd3b39b25efb7a8eb5373c8a51675c325f577..528c8c0aaf2a680494432de13e7f3dd64628f908 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -754,6 +754,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1259,
 /**/
     1258,
 /**/