vim-patch:8.1.2018: using freed memory when out of memory and displaying message

Problem:    Using freed memory when out of memory and displaying message.
Solution:   Make a copy of the message first.
https://github.com/vim/vim/commit/e5fbd7393067c279860598ac8359d1617b1082b9

3 files changed, 12 insertions, 10 deletions

diff --git a/src/nvim/globals.h b/src/nvim/globals.h
index 08a217a6e8..d6d00d6e83 100644
--- a/src/nvim/globals.h
+++ b/src/nvim/globals.h
@@ -203,7 +203,7 @@ EXTERN int msg_nowait INIT(= false);        // don't wait for this msg
 EXTERN int emsg_off INIT(= 0);              // don't display errors for now,
                                             // unless 'debug' is set.
 EXTERN int info_message INIT(= false);      // printing informative message
-EXTERN int msg_hist_off INIT(= false);      // don't add messages to history
+EXTERN bool msg_hist_off INIT(= false);     // don't add messages to history
 EXTERN int need_clr_eos INIT(= false);      // need to clear text before
                                             // displaying a message.
 EXTERN int emsg_skip INIT(= 0);             // don't display errors for
diff --git a/src/nvim/message.c b/src/nvim/message.c
index 9aa588e035..8999365d32 100644
--- a/src/nvim/message.c
+++ b/src/nvim/message.c
@@ -306,11 +306,6 @@ bool msg_attr_keep(char_u *s, int attr, bool keep, bool multiline)
     add_msg_hist((const char *)s, -1, attr, multiline);
   }
 
-  /* When displaying keep_msg, don't let msg_start() free it, caller must do
-   * that. */
-  if (s == keep_msg)
-    keep_msg = NULL;
-
   /* Truncate the message if needed. */
   msg_start();
   buf = msg_strtrunc(s, FALSE);
diff --git a/src/nvim/normal.c b/src/nvim/normal.c
index 87d687198d..968cfde388 100644
--- a/src/nvim/normal.c
+++ b/src/nvim/normal.c
@@ -621,6 +621,8 @@ static void normal_redraw_mode_message(NormalState *s)
     update_screen(0);
     // now reset it, otherwise it's put in the history again
     keep_msg = kmsg;
+
+    kmsg = vim_strsave(keep_msg);
     msg_attr((const char *)kmsg, keep_msg_attr);
     xfree(kmsg);
   }
@@ -1265,10 +1267,15 @@ static void normal_redraw(NormalState *s)
   // Display message after redraw. If an external message is still visible,
   // it contains the kept message already.
   if (keep_msg != NULL && !msg_ext_is_visible()) {
-    // msg_attr_keep() will set keep_msg to NULL, must free the string here.
-    // Don't reset keep_msg, msg_attr_keep() uses it to check for duplicates.
-    char *p = (char *)keep_msg;
-    msg_attr(p, keep_msg_attr);
+    char_u *const p = vim_strsave(keep_msg);
+
+    // msg_start() will set keep_msg to NULL, make a copy
+    // first.  Don't reset keep_msg, msg_attr_keep() uses it to
+    // check for duplicates.  Never put this message in
+    // history.
+    msg_hist_off = true;
+    msg_attr((const char *)p, keep_msg_attr);
+    msg_hist_off = false;
     xfree(p);
   }