From 74f8eece5e481220e3c0767487c0bb59fa916ed6 Mon Sep 17 00:00:00 2001 From: Bram Moolenaar Date: Thu, 15 Oct 2020 19:10:56 +0200 Subject: patch 8.2.1848: crash when passing a NULL string or list to popup_settext() Problem: Crashyyyyy passing a NULL string or list to popup_settext(). Solution: Check for NULL pointers. (closes #7132) --- src/popupwin.c | 6 ++++-- src/testdir/test_popupwin.vim | 10 ++++++++++ src/version.c | 2 ++ 3 files changed, 16 insertions(+), 2 deletions(-) (limited to 'src') diff --git a/src/popupwin.c b/src/popupwin.c index 05db1af631..777e7d84b1 100644 --- a/src/popupwin.c +++ b/src/popupwin.c @@ -1595,14 +1595,16 @@ popup_set_buffer_text(buf_T *buf, typval_T text) // Add text to the buffer. if (text.v_type == VAR_STRING) { + char_u *s = text.vval.v_string; + // just a string - ml_append_buf(buf, 0, text.vval.v_string, (colnr_T)0, TRUE); + ml_append_buf(buf, 0, s == NULL ? (char_u *)"" : s, (colnr_T)0, TRUE); } else { list_T *l = text.vval.v_list; - if (l->lv_len > 0) + if (l != NULL && l->lv_len > 0) { if (l->lv_first->li_tv.v_type == VAR_STRING) // list of strings diff --git a/src/testdir/test_popupwin.vim b/src/testdir/test_popupwin.vim index 187b4f13eb..1524e78563 100644 --- a/src/testdir/test_popupwin.vim +++ b/src/testdir/test_popupwin.vim @@ -2363,6 +2363,16 @@ func Test_popup_settext_getline() call popup_close(id) endfunc +func Test_popup_settext_null() + let id = popup_create('', #{ tabpage: 0 }) + call popup_settext(id, test_null_list()) + call popup_close(id) + + let id = popup_create('', #{ tabpage: 0 }) + call popup_settext(id, test_null_string()) + call popup_close(id) +endfunc + func Test_popup_hidden() new diff --git a/src/version.c b/src/version.c index b95e0e9921..b0fe5e8e15 100644 --- a/src/version.c +++ b/src/version.c @@ -750,6 +750,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 1848, /**/ 1847, /**/ -- cgit v1.2.3