To: vim_dev@googlegroups.com
Subject: Patch 9.0.1030
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 9.0.1030
Problem:    Using freed memory with the cmdline popup menu.
Solution:   Clear the popup menu when clearing the matches. (closes #11677)
Files:      src/cmdexpand.c, src/testdir/test_cmdline.vim,
            src/testdir/dumps/Test_wildmenu_pum_clear_entries_1.dump


*** ../vim-9.0.1029/src/cmdexpand.c	2022-11-14 22:07:41.340221360 +0000
--- src/cmdexpand.c	2022-12-08 12:00:18.810050338 +0000
***************
*** 369,375 ****
  /*
   * Display the cmdline completion matches in a popup menu
   */
! void cmdline_pum_display(void)
  {
      pum_display(compl_match_array, compl_match_arraysize, compl_selected);
  }
--- 369,376 ----
  /*
   * Display the cmdline completion matches in a popup menu
   */
!     void
! cmdline_pum_display(void)
  {
      pum_display(compl_match_array, compl_match_arraysize, compl_selected);
  }
***************
*** 377,383 ****
  /*
   * Returns TRUE if the cmdline completion popup menu is being displayed.
   */
! int cmdline_pum_active(void)
  {
      return pum_visible() && compl_match_array != NULL;
  }
--- 378,385 ----
  /*
   * Returns TRUE if the cmdline completion popup menu is being displayed.
   */
!     int
! cmdline_pum_active(void)
  {
      return pum_visible() && compl_match_array != NULL;
  }
***************
*** 386,392 ****
   * Remove the cmdline completion popup menu (if present), free the list of
   * items and refresh the screen.
   */
! void cmdline_pum_remove(void)
  {
      int save_p_lz = p_lz;
      int	save_KeyTyped = KeyTyped;
--- 388,395 ----
   * Remove the cmdline completion popup menu (if present), free the list of
   * items and refresh the screen.
   */
!     void
! cmdline_pum_remove(void)
  {
      int save_p_lz = p_lz;
      int	save_KeyTyped = KeyTyped;
***************
*** 403,409 ****
      KeyTyped = save_KeyTyped;
  }
  
! void cmdline_pum_cleanup(cmdline_info_T *cclp)
  {
      cmdline_pum_remove();
      wildmenu_cleanup(cclp);
--- 406,413 ----
      KeyTyped = save_KeyTyped;
  }
  
!     void
! cmdline_pum_cleanup(cmdline_info_T *cclp)
  {
      cmdline_pum_remove();
      wildmenu_cleanup(cclp);
***************
*** 413,419 ****
   * Returns the starting column number to use for the cmdline completion popup
   * menu.
   */
! int cmdline_compl_startcol(void)
  {
      return compl_startcol;
  }
--- 417,424 ----
   * Returns the starting column number to use for the cmdline completion popup
   * menu.
   */
!     int
! cmdline_compl_startcol(void)
  {
      return compl_startcol;
  }
***************
*** 975,980 ****
--- 980,989 ----
  	FreeWild(xp->xp_numfiles, xp->xp_files);
  	xp->xp_numfiles = -1;
  	VIM_CLEAR(orig_save);
+ 
+ 	// The entries from xp_files may be used in the PUM, remove it.
+ 	if (compl_match_array != NULL)
+ 	    cmdline_pum_remove();
      }
      findex = 0;
  
*** ../vim-9.0.1029/src/testdir/test_cmdline.vim	2022-11-08 21:39:59.937440725 +0000
--- src/testdir/test_cmdline.vim	2022-12-08 11:54:55.329958289 +0000
***************
*** 2485,2490 ****
--- 2485,2505 ----
    call StopVimInTerminal(buf)
  endfunc
  
+ func Test_wildmenu_pum_clear_entries()
+   " This was using freed memory.  Run in a terminal to get the pum to update.
+   let lines =<< trim END
+     set wildoptions=pum
+     set wildchar=<C-E>
+   END
+   call writefile(lines, 'XwildmenuTest', 'D')
+   let buf = RunVimInTerminal('-S XwildmenuTest', #{rows: 10})
+ 
+   call term_sendkeys(buf, ":\<C-E>\<C-E>")
+   call VerifyScreenDump(buf, 'Test_wildmenu_pum_clear_entries_1', {})
+ 
+   set wildoptions& wildchar&
+ endfunc
+ 
  " Test for completion after a :substitute command followed by a pipe (|)
  " character
  func Test_cmdline_complete_substitute()
*** ../vim-9.0.1029/src/testdir/dumps/Test_wildmenu_pum_clear_entries_1.dump	2022-12-08 11:58:30.690018395 +0000
--- src/testdir/dumps/Test_wildmenu_pum_clear_entries_1.dump	2022-12-08 11:55:13.269963081 +0000
***************
*** 0 ****
--- 1,10 ----
+ | +0#0000001#e0e0e08|!| @14| +0#0000000#0000001| +0&#ffffff0@56
+ | +0#0000001#ffd7ff255|#| @14| +0#0000000#a8a8a8255| +0#4040ff13#ffffff0@56
+ | +0#0000001#ffd7ff255|&| @14| +0#0000000#a8a8a8255| +0#4040ff13#ffffff0@56
+ | +0#0000001#ffd7ff255|*| @14| +0#0000000#a8a8a8255| +0#4040ff13#ffffff0@56
+ | +0#0000001#ffd7ff255|+@1| @13| +0#0000000#a8a8a8255| +0#4040ff13#ffffff0@56
+ | +0#0000001#ffd7ff255|-@1| @13| +0#0000000#a8a8a8255| +0#4040ff13#ffffff0@56
+ | +0#0000001#ffd7ff255|<| @14| +0#0000000#a8a8a8255| +0#4040ff13#ffffff0@56
+ | +0#0000001#ffd7ff255|=| @14| +0#0000000#a8a8a8255| +0#4040ff13#ffffff0@56
+ | +0#0000001#ffd7ff255|>| @14| +0#0000000#a8a8a8255| +0#4040ff13#ffffff0@56
+ |:+0#0000000&|!> @72
*** ../vim-9.0.1029/src/version.c	2022-12-08 10:03:44.941812028 +0000
--- src/version.c	2022-12-08 11:42:55.009829660 +0000
***************
*** 697,698 ****
--- 697,700 ----
  {   /* Add new patch number below this line */
+ /**/
+     1030,
  /**/

-- 
hundred-and-one symptoms of being an internet addict:
262. Your computer has it's own phone line - but your daughter doesn't.

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///                                                                      \\\
\\\        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///