fix(messages): allocate message history kind string #38292

Problem:  nvim_echo()->kind memory may be used after it is freed with :messages.
Solution: Copy and free message kind string in message history.

1 files changed, 9 insertions, 0 deletions

diff --git a/test/functional/api/vim_spec.lua b/test/functional/api/vim_spec.lua
index 5e36a63264..92a7c8af25 100644
--- a/test/functional/api/vim_spec.lua
+++ b/test/functional/api/vim_spec.lua
@@ -3887,6 +3887,15 @@ describe('API', function()
       eq(4, api.nvim_echo({ { 'foo' } }, false, { id = 4 }))
       eq(5, api.nvim_echo({ { 'foo' } }, false, {}))
     end)
+
+    it('no use-after-free for custom kind with :messages #38289', function()
+      exec_lua(function()
+        vim.api.nvim_echo({ { 'a' } }, true, { kind = 'foo' })
+        vim.o.guicursor = '' -- pending mode update go brrr
+        vim.api.nvim__redraw({ flush = true }) -- ui_flush -> arena_mem_free go brrr
+        vim.cmd.messages()
+      end)
+    end)
   end)
 
   describe('nvim_open_term', function()