From fd02e63513f299394a4a95fc271fbd86d48af30a Mon Sep 17 00:00:00 2001
From: erw7 <erw7.github@gmail.com>
Date: Sat, 1 Aug 2020 01:52:15 +0900
Subject: [PATCH 1/2] ui: fix problem with sattr_T overflow

sattr_T was defined as uint16_t. But this is not enough to handle the
24-bit colors of the terminal. To solve this problem, change it to int.
In 32bit, int may overflow. So, if it overflows, change it to ignore it
without adding more attr_entries.

fixes #12366

(cherry picked from commit 872ecf65d10f0d22bbf3e2257f9ae89a6c61d2f4)
---
 src/nvim/grid_defs.h | 2 +-
 src/nvim/highlight.c | 7 ++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/nvim/grid_defs.h b/src/nvim/grid_defs.h
index 9e588d0387..ce90886978 100644
--- a/src/nvim/grid_defs.h
+++ b/src/nvim/grid_defs.h
@@ -11,7 +11,7 @@
 
 // The characters and attributes drawn on grids.
 typedef char_u schar_T[(MAX_MCO+1) * 4 + 1];
-typedef int16_t sattr_T;
+typedef int sattr_T;
 
 /// ScreenGrid represents a resizable rectuangular grid displayed by UI clients.
 ///
diff --git a/src/nvim/highlight.c b/src/nvim/highlight.c
index 093cc4923b..2783a327b2 100644
--- a/src/nvim/highlight.c
+++ b/src/nvim/highlight.c
@@ -90,7 +90,12 @@ static int get_attr_entry(HlEntry entry)
     }
   }
 
-  id = (int)kv_size(attr_entries);
+  size_t next_id = kv_size(attr_entries);
+  if (next_id > INT_MAX) {
+    ELOG("The index on attr_entries has overflowed");
+    return 0;
+  }
+  id = (int)next_id;
   kv_push(attr_entries, entry);
 
   map_put(HlEntry, int)(attr_entry_ids, entry, id);

From 23c99bb78f8f331551d93630ff0190628badbba9 Mon Sep 17 00:00:00 2001
From: Jan Edmund Lazo <jan.lazo@mail.utoronto.ca>
Date: Tue, 21 Jul 2020 18:51:47 -0400
Subject: [PATCH 2/2] vim-patch:8.2.1259: empty group in 'tabline' may cause
 using an invalid pointer

Problem:    Empty group in 'tabline' may cause using an invalid pointer.
Solution:   Set the group start position. (closes vim/vim#6505)
https://github.com/vim/vim/commit/f56c95fdad5af521887f8cd7bc15729b5355231d
(cherry picked from commit 9443d3994190943c2b9d8c4efefcf3de854ec7be)
---
 src/nvim/buffer.c                 |  8 +++++++-
 src/nvim/testdir/test_tabline.vim | 25 +++++++++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/src/nvim/buffer.c b/src/nvim/buffer.c
index 1a925f2fd6..b34ac4d922 100644
--- a/src/nvim/buffer.c
+++ b/src/nvim/buffer.c
@@ -3530,13 +3530,19 @@ int build_stl_str_hl(
           }
         }
         if (n == curitem && group_start_userhl == group_end_userhl) {
+          // empty group
           out_p = t;
           group_len = 0;
-          // do not use the highlighting from the removed group
           for (n = groupitems[groupdepth] + 1; n < curitem; n++) {
+            // do not use the highlighting from the removed group
             if (items[n].type == Highlight) {
               items[n].type = Empty;
             }
+            // adjust the start position of TabPage to the next
+            // item position
+            if (items[n].type == TabPage) {
+              items[n].start = out_p;
+            }
           }
         }
       }
diff --git a/src/nvim/testdir/test_tabline.vim b/src/nvim/testdir/test_tabline.vim
index f24552088b..117d962d08 100644
--- a/src/nvim/testdir/test_tabline.vim
+++ b/src/nvim/testdir/test_tabline.vim
@@ -64,3 +64,28 @@ func Test_redrawtabline()
   let &showtabline = showtabline_save
   au! Bufadd
 endfunc
+
+function EmptyTabname()
+  return ""
+endfunction
+
+function MakeTabLine() abort
+  let titles = map(range(1, tabpagenr('$')), '"%( %" . v:val . "T%{EmptyTabname()}%T %)"')
+  let sep = 'あ'
+  let tabpages = join(titles, sep)
+  return tabpages .. sep .. '%=%999X X'
+endfunction
+
+func Test_tabline_empty_group()
+  " this was reading invalid memory
+  set tabline=%!MakeTabLine()
+  tabnew
+  redraw!
+
+  tabclose
+  set tabline=
+endfunc
+
+
+
+" vim: shiftwidth=2 sts=2 expandtab