From 6fe677c108c9a84be998a9355ae9700348cb0cc5 Mon Sep 17 00:00:00 2001
From: Matthew Malcomson <hardenedapple@gmail.com>
Date: Fri, 27 Jan 2017 12:09:33 +0000
Subject: api: nvim_buf_set_lines(): Avoid invalid ml_get. #6019

When the buffer that nvim_buf_set_lines() is changing is not in any vim
window, fix_cursor() leads to calling ml_get_buf() with an invalid line
number. The condition that fix_cursor() was called on was (buf ==
curbuf), but this is always true because of the call to
switch_to_win_for_buf() earlier in the function.

Instead this should be predicated on (save_curbuf.br_buf == NULL)
---
 test/functional/api/buffer_spec.lua | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

(limited to 'test')

diff --git a/test/functional/api/buffer_spec.lua b/test/functional/api/buffer_spec.lua
index e7e2168238..552e3a8564 100644
--- a/test/functional/api/buffer_spec.lua
+++ b/test/functional/api/buffer_spec.lua
@@ -4,6 +4,9 @@ local curbuf, curwin, eq = helpers.curbuf, helpers.curwin, helpers.eq
 local curbufmeths, ok = helpers.curbufmeths, helpers.ok
 local funcs = helpers.funcs
 local request = helpers.request
+local exc_exec = helpers.exc_exec
+local execute = helpers.execute
+local insert = helpers.insert
 local NIL = helpers.NIL
 local meth_pcall = helpers.meth_pcall
 local command = helpers.command
@@ -242,6 +245,22 @@ describe('api/buf', function()
       eq({'e', 'a', 'b', 'c', 'd'}, get_lines(0, -1, true))
     end)
 
+    it("set_line on alternate buffer does not access invalid line (E315)", function()
+      execute('set hidden')
+      insert('Initial file')
+      command('enew')
+      insert([[
+      More
+      Lines
+      Than
+      In
+      The
+      Other
+      Buffer]])
+      execute('$')
+      local retval = exc_exec("call nvim_buf_set_lines(1, 0, 1, v:false, ['test'])")
+      eq(0, retval)
+    end)
   end)
 
   describe('{get,set,del}_var', function()
-- 
cgit