mirror of
https://github.com/kovidgoyal/kitty
synced 2026-07-24 01:08:10 +02:00
Fix crash in overlay line drawing on uninitialized linebuf view
screen_draw_overlay_line accessed self->linebuf->line->cpu_cells without ever calling linebuf_init_line on the shared view. Render paths that initialize a stack-local Line via render_line_for_virtual_y left the view's cpu_cells as NULL (the value set by alloc_line via PyType_GenericAlloc), and the multicell-trim loop then dereferenced NULL + xstart * sizeof(CPUCell), producing a SIGSEGV at a small address (e.g. 0x1e for xstart=2). The crash was reachable any time an IME pre-edit overlay was rendered with the cursor not in column 0 on a screen whose linebuf->line had not been re-pointed by some unrelated prior call. Fix by initializing the view at the overlay row on entry. Add a test_draw_overlay_line method on Screen so the behavior can be exercised directly from a regression test.
This commit is contained in:
@@ -14,6 +14,18 @@ class TestMulticell(BaseTest):
|
||||
def test_multicell(self):
|
||||
test_multicell(self)
|
||||
|
||||
def test_overlay_line_does_not_crash_on_uninit_linebuf_view(self):
|
||||
# Regression: screen_draw_overlay_line accessed self->linebuf->line->cpu_cells
|
||||
# without ever calling linebuf_init_line, so on render paths that
|
||||
# initialize a stack-local Line (render_line_for_virtual_y) the shared
|
||||
# view's cpu_cells stayed NULL and the multicell-trim loop dereferenced
|
||||
# NULL + xstart * sizeof(CPUCell). Reproduces by placing a wide cell at
|
||||
# xstart>0 and triggering the overlay draw directly.
|
||||
for xstart in (1, 2, 3):
|
||||
s = self.create_screen(cols=10, lines=5)
|
||||
s.draw('好好') # two 2-cell wide chars covering columns 0..3
|
||||
s.test_draw_overlay_line('xy', xstart, 0) # would SIGSEGV without fix
|
||||
|
||||
|
||||
def test_multicell(self: TestMulticell) -> None:
|
||||
from kitty.tab_bar import as_rgb
|
||||
|
||||
Reference in New Issue
Block a user