On Wed, Nov 20, 2019 at 10:59:32PM +0100, Bram Moolenaar ([email protected]) 
wrote:
> 
> Markus Braun wrote:
> 
> > > Because there are several entries in "ga.ga_data" that have a "bytelen"
> > > of 0 the for loop in line 1212 is never executed and thus the variable
> > > "line" is never incremented. Thus the "item_idx" is incremented above
> > > the value of "ga.ga_len" which causes accessing an invalid entry.
> > 
> > After thinking about this a second time I think the problem is that the
> > empty line in the input message is skipped because "bytelen" is 0.
> > So either the height should be calculated for the message excluding the
> > embedded empty line or an empty line should be inserted into the
> > formatted message.
> 
> What is the value of "mesg"?  That's the only input, thus if we know
> that we should be able to reproduce.

The value of "mesg" is "Declared in global namespace\n\ntypedef __uint32_t 
uint32_t"

The problem seems to be the consecutive '\n'. Because of that
ga.ga_data[1].start points to "\ntypedef __uint32_t uint32_t" and
ga.ga_data[1].bytelen is 0 which then causes skipping of this element
when preparing the formatted "array".

I've done a patch locally and it seems to fix the problem. But I don't
know if this is the right solution. Patch is attached. Maybe it makes my
above explanation little bit clearer ;-)

Markus Braun

-- 
Any errors in spelling, tact or fact are transmission errors

-- 
-- 
You received this message from the "vim_dev" maillist.
Do not top-post! Type your reply below the text you are replying to.
For more information, visit http://www.vim.org/maillist.php

--- 
You received this message because you are subscribed to the Google Groups 
"vim_dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion on the web visit 
https://groups.google.com/d/msgid/vim_dev/20191121085842.GA19779%40home.krawel.de.
diff --git a/src/popupmenu.c b/src/popupmenu.c
index 55845cf2d..49b689aee 100644
--- a/src/popupmenu.c
+++ b/src/popupmenu.c
@@ -1209,41 +1209,47 @@ split_message(char_u *mesg, pumitem_T **array)
 	int	cells;
 
 	item = ((balpart_T *)ga.ga_data) + item_idx;
-	for (skip = 0; skip < item->bytelen; skip += thislen)
-	{
-	    if (split_long_items && item->cells >= BALLOON_MIN_WIDTH)
+	if (item->bytelen == 0) {
+	    (*array)[line].pum_text = vim_strsave((char_u *)"");
+	    ++line;
+	}
+	else {
+	    for (skip = 0; skip < item->bytelen; skip += thislen)
 	    {
-		cells = item->indent * 2;
-		for (p = item->start + skip; p < item->start + item->bytelen;
-							    p += mb_ptr2len(p))
-		    if ((cells += ptr2cells(p)) > BALLOON_MIN_WIDTH)
-			break;
-		thislen = p - (item->start + skip);
-	    }
-	    else
-		thislen = item->bytelen;
+		if (split_long_items && item->cells >= BALLOON_MIN_WIDTH)
+		{
+		    cells = item->indent * 2;
+		    for (p = item->start + skip; p < item->start + item->bytelen;
+			 p += mb_ptr2len(p))
+			if ((cells += ptr2cells(p)) > BALLOON_MIN_WIDTH)
+			    break;
+		    thislen = p - (item->start + skip);
+		}
+		else
+		    thislen = item->bytelen;
 
-	    // put indent at the start
-	    p = alloc(thislen + item->indent * 2 + 1);
-	    if (p == NULL)
-	    {
-		for (line = 0; line <= height - 1; ++line)
-		    vim_free((*array)[line].pum_text);
-		vim_free(*array);
-		goto failed;
-	    }
-	    for (ind = 0; ind < item->indent * 2; ++ind)
-		p[ind] = ' ';
+		// put indent at the start
+		p = alloc(thislen + item->indent * 2 + 1);
+		if (p == NULL)
+		{
+		    for (line = 0; line <= height - 1; ++line)
+			vim_free((*array)[line].pum_text);
+		    vim_free(*array);
+		    goto failed;
+		}
+		for (ind = 0; ind < item->indent * 2; ++ind)
+		    p[ind] = ' ';
 
-	    // exclude spaces at the end of the string
-	    for (copylen = thislen; copylen > 0; --copylen)
-		if (item->start[skip + copylen - 1] != ' ')
-		    break;
+		// exclude spaces at the end of the string
+		for (copylen = thislen; copylen > 0; --copylen)
+		    if (item->start[skip + copylen - 1] != ' ')
+			break;
 
-	    vim_strncpy(p + ind, item->start + skip, copylen);
-	    (*array)[line].pum_text = p;
-	    item->indent = 0;  /* wrapped line has no indent */
-	    ++line;
+		vim_strncpy(p + ind, item->start + skip, copylen);
+		(*array)[line].pum_text = p;
+		item->indent = 0;  /* wrapped line has no indent */
+		++line;
+	    }
 	}
     }
     ga_clear(&ga);

Raspunde prin e-mail lui