Merge pull request #12717 from jamessan/release-0.4-backports

4 files changed, 39 insertions, 3 deletions

diff --git a/src/nvim/buffer.c b/src/nvim/buffer.c
index 1a925f2fd6..b34ac4d922 100644
--- a/src/nvim/buffer.c
+++ b/src/nvim/buffer.c
@@ -3530,13 +3530,19 @@ int build_stl_str_hl(
           }
         }
         if (n == curitem && group_start_userhl == group_end_userhl) {
+          // empty group
           out_p = t;
           group_len = 0;
-          // do not use the highlighting from the removed group
           for (n = groupitems[groupdepth] + 1; n < curitem; n++) {
+            // do not use the highlighting from the removed group
             if (items[n].type == Highlight) {
               items[n].type = Empty;
             }
+            // adjust the start position of TabPage to the next
+            // item position
+            if (items[n].type == TabPage) {
+              items[n].start = out_p;
+            }
           }
         }
       }
diff --git a/src/nvim/grid_defs.h b/src/nvim/grid_defs.h
index 9e588d0387..ce90886978 100644
--- a/src/nvim/grid_defs.h
+++ b/src/nvim/grid_defs.h
@@ -11,7 +11,7 @@
 
 // The characters and attributes drawn on grids.
 typedef char_u schar_T[(MAX_MCO+1) * 4 + 1];
-typedef int16_t sattr_T;
+typedef int sattr_T;
 
 /// ScreenGrid represents a resizable rectuangular grid displayed by UI clients.
 ///
diff --git a/src/nvim/highlight.c b/src/nvim/highlight.c
index 093cc4923b..2783a327b2 100644
--- a/src/nvim/highlight.c
+++ b/src/nvim/highlight.c
@@ -90,7 +90,12 @@ static int get_attr_entry(HlEntry entry)
     }
   }
 
-  id = (int)kv_size(attr_entries);
+  size_t next_id = kv_size(attr_entries);
+  if (next_id > INT_MAX) {
+    ELOG("The index on attr_entries has overflowed");
+    return 0;
+  }
+  id = (int)next_id;
   kv_push(attr_entries, entry);
 
   map_put(HlEntry, int)(attr_entry_ids, entry, id);
diff --git a/src/nvim/testdir/test_tabline.vim b/src/nvim/testdir/test_tabline.vim
index f24552088b..117d962d08 100644
--- a/src/nvim/testdir/test_tabline.vim
+++ b/src/nvim/testdir/test_tabline.vim
@@ -64,3 +64,28 @@ func Test_redrawtabline()
   let &showtabline = showtabline_save
   au! Bufadd
 endfunc
+
+function EmptyTabname()
+  return ""
+endfunction
+
+function MakeTabLine() abort
+  let titles = map(range(1, tabpagenr('$')), '"%( %" . v:val . "T%{EmptyTabname()}%T %)"')
+  let sep = 'あ'
+  let tabpages = join(titles, sep)
+  return tabpages .. sep .. '%=%999X X'
+endfunction
+
+func Test_tabline_empty_group()
+  " this was reading invalid memory
+  set tabline=%!MakeTabLine()
+  tabnew
+  redraw!
+
+  tabclose
+  set tabline=
+endfunc
+
+
+
+" vim: shiftwidth=2 sts=2 expandtab