fix(api): crash after nvim_win_set_config title/footer validation error (#26606)

2 files changed, 52 insertions, 18 deletions

diff --git a/src/nvim/api/win_config.c b/src/nvim/api/win_config.c
index 856fac5585..4ffe3478d7 100644
--- a/src/nvim/api/win_config.c
+++ b/src/nvim/api/win_config.c
@@ -431,18 +431,36 @@ static bool parse_float_bufpos(Array bufpos, lpos_T *out)
 static void parse_bordertext(Object bordertext, BorderTextType bordertext_type,
                              FloatConfig *fconfig, Error *err)
 {
+  if (bordertext.type != kObjectTypeString && bordertext.type != kObjectTypeArray) {
+    api_set_error(err, kErrorTypeValidation, "title/footer must be string or array");
+    return;
+  }
+
+  if (bordertext.type == kObjectTypeArray && bordertext.data.array.size == 0) {
+    api_set_error(err, kErrorTypeValidation, "title/footer cannot be an empty array");
+    return;
+  }
+
   bool *is_present;
   VirtText *chunks;
   int *width;
   int default_hl_id;
   switch (bordertext_type) {
   case kBorderTextTitle:
+    if (fconfig->title) {
+      clear_virttext(&fconfig->title_chunks);
+    }
+
     is_present = &fconfig->title;
     chunks = &fconfig->title_chunks;
     width = &fconfig->title_width;
     default_hl_id = syn_check_group(S_LEN("FloatTitle"));
     break;
   case kBorderTextFooter:
+    if (fconfig->footer) {
+      clear_virttext(&fconfig->footer_chunks);
+    }
+
     is_present = &fconfig->footer;
     chunks = &fconfig->footer_chunks;
     width = &fconfig->footer_width;
@@ -462,16 +480,6 @@ static void parse_bordertext(Object bordertext, BorderTextType bordertext_type,
     return;
   }
 
-  if (bordertext.type != kObjectTypeArray) {
-    api_set_error(err, kErrorTypeValidation, "title must be string or array");
-    return;
-  }
-
-  if (bordertext.data.array.size == 0) {
-    api_set_error(err, kErrorTypeValidation, "title cannot be an empty array");
-    return;
-  }
-
   *width = 0;
   *chunks = parse_virt_text(bordertext.data.array, err, width);
 
@@ -774,10 +782,6 @@ static bool parse_float_config(Dict(float_config) *config, FloatConfig *fconfig,
       return false;
     }
 
-    if (fconfig->title) {
-      clear_virttext(&fconfig->title_chunks);
-    }
-
     parse_bordertext(config->title, kBorderTextTitle, fconfig, err);
     if (ERROR_SET(err)) {
       return false;
@@ -801,10 +805,6 @@ static bool parse_float_config(Dict(float_config) *config, FloatConfig *fconfig,
       return false;
     }
 
-    if (fconfig->footer) {
-      clear_virttext(&fconfig->footer_chunks);
-    }
-
     parse_bordertext(config->footer, kBorderTextFooter, fconfig, err);
     if (ERROR_SET(err)) {
       return false;
diff --git a/test/functional/api/window_spec.lua b/test/functional/api/window_spec.lua
index 67284c01e0..f44326d0eb 100644
--- a/test/functional/api/window_spec.lua
+++ b/test/functional/api/window_spec.lua
@@ -906,4 +906,38 @@ describe('API/win', function()
       eq(footer, cfg.footer)
     end)
   end)
+
+  describe('set_config', function()
+    it('no crash with invalid title', function ()
+      local win = meths.open_win(0, true, {
+        width = 10,
+        height = 10,
+        relative = "editor",
+        row = 10,
+        col = 10,
+        title = { { "test" } },
+        border = "single",
+      })
+      eq("title/footer cannot be an empty array",
+          pcall_err(meths.win_set_config, win, {title = {}}))
+      command("redraw!")
+      assert_alive()
+    end)
+
+    it('no crash with invalid footer', function ()
+      local win = meths.open_win(0, true, {
+        width = 10,
+        height = 10,
+        relative = "editor",
+        row = 10,
+        col = 10,
+        footer = { { "test" } },
+        border = "single",
+      })
+      eq("title/footer cannot be an empty array",
+          pcall_err(meths.win_set_config, win, {footer = {}}))
+      command("redraw!")
+      assert_alive()
+    end)
+  end)
 end)