vim-patch:8.2.1259: empty group in 'tabline' may cause using an invalid pointer

Problem:    Empty group in 'tabline' may cause using an invalid pointer.
Solution:   Set the group start position. (closes vim/vim#6505)
https://github.com/vim/vim/commit/f56c95fdad5af521887f8cd7bc15729b5355231d

2 files changed, 32 insertions, 1 deletions

diff --git a/src/nvim/buffer.c b/src/nvim/buffer.c
index 86067aceac..b3bbdce9d9 100644
--- a/src/nvim/buffer.c
+++ b/src/nvim/buffer.c
@@ -3646,13 +3646,19 @@ int build_stl_str_hl(
           }
         }
         if (n == curitem && group_start_userhl == group_end_userhl) {
+          // empty group
           out_p = t;
           group_len = 0;
-          // do not use the highlighting from the removed group
           for (n = groupitems[groupdepth] + 1; n < curitem; n++) {
+            // do not use the highlighting from the removed group
             if (items[n].type == Highlight) {
               items[n].type = Empty;
             }
+            // adjust the start position of TabPage to the next
+            // item position
+            if (items[n].type == TabPage) {
+              items[n].start = out_p;
+            }
           }
         }
       }
diff --git a/src/nvim/testdir/test_tabline.vim b/src/nvim/testdir/test_tabline.vim
index f24552088b..117d962d08 100644
--- a/src/nvim/testdir/test_tabline.vim
+++ b/src/nvim/testdir/test_tabline.vim
@@ -64,3 +64,28 @@ func Test_redrawtabline()
   let &showtabline = showtabline_save
   au! Bufadd
 endfunc
+
+function EmptyTabname()
+  return ""
+endfunction
+
+function MakeTabLine() abort
+  let titles = map(range(1, tabpagenr('$')), '"%( %" . v:val . "T%{EmptyTabname()}%T %)"')
+  let sep = 'あ'
+  let tabpages = join(titles, sep)
+  return tabpages .. sep .. '%=%999X X'
+endfunction
+
+func Test_tabline_empty_group()
+  " this was reading invalid memory
+  set tabline=%!MakeTabLine()
+  tabnew
+  redraw!
+
+  tabclose
+  set tabline=
+endfunc
+
+
+
+" vim: shiftwidth=2 sts=2 expandtab