From 6598d7b1b2d4d69f805288384b72a076666ca5ca Mon Sep 17 00:00:00 2001
From: Maxime Coste <mawww@kakoune.org>
Date: Fri, 22 Mar 2024 22:06:11 +1100
Subject: [PATCH] Fix invalid access when recording keys

<c-n>/<c-p> handling in insert was always dropping the last key in
the last_insert() vector (in order to replace it with the actual
completion text inserted), this was not valid for synthetized keys
that are not added to that vector in the first place.

Take the opportunity to merge insert completion handling code between
<c-n>/<c-p> and direct menu selection.

Fixes #5120
---
 src/input_handler.cc                          | 23 ++++-------
 .../5120-double-free-or-corruption-crash/cmd  |  1 +
 .../5120-double-free-or-corruption-crash/in   | 40 +++++++++++++++++++
 3 files changed, 48 insertions(+), 16 deletions(-)
 create mode 100644 test/regression/5120-double-free-or-corruption-crash/cmd
 create mode 100644 test/regression/5120-double-free-or-corruption-crash/in

diff --git a/src/input_handler.cc b/src/input_handler.cc
index 9d81f711..5800a6a0 100644
--- a/src/input_handler.cc
+++ b/src/input_handler.cc
@@ -1191,7 +1191,7 @@ public:
         }
     }
 
-    void on_key(Key key, bool) override
+    void on_key(Key key, bool synthesized) override
     {
         auto& buffer = context().buffer();
 
@@ -1289,22 +1289,13 @@ public:
                 }, "enter register name", register_doc.str());
             update_completions = false;
         }
-        else if (key == ctrl('n'))
+        else if (key == ctrl('n') or key == ctrl('p') or key.modifiers == Key::Modifiers::MenuSelect)
         {
-            last_insert().keys.pop_back();
-            m_completer.select(1, true, last_insert().keys);
-            update_completions = false;
-        }
-        else if (key == ctrl('p'))
-        {
-            last_insert().keys.pop_back();
-            m_completer.select(-1, true, last_insert().keys);
-            update_completions = false;
-        }
-        else if (key.modifiers == Key::Modifiers::MenuSelect)
-        {
-            last_insert().keys.pop_back();
-            m_completer.select(key.key, false, last_insert().keys);
+            if (not synthesized)
+                last_insert().keys.pop_back();
+            bool relative = key.modifiers != Key::Modifiers::MenuSelect;
+            int index = relative ? (key == ctrl('n') ? 1 : -1) : key.key;
+            m_completer.select(index, relative, last_insert().keys);
             update_completions = false;
         }
         else if (key == ctrl('x'))
diff --git a/test/regression/5120-double-free-or-corruption-crash/cmd b/test/regression/5120-double-free-or-corruption-crash/cmd
new file mode 100644
index 00000000..3076ee65
--- /dev/null
+++ b/test/regression/5120-double-free-or-corruption-crash/cmd
@@ -0,0 +1 @@
+ggQm*nWd<a-l>d<a-d>n<a-c>\fo<c-n>{<c-r>"}<esc>Q8q
diff --git a/test/regression/5120-double-free-or-corruption-crash/in b/test/regression/5120-double-free-or-corruption-crash/in
new file mode 100644
index 00000000..ca91936a
--- /dev/null
+++ b/test/regression/5120-double-free-or-corruption-crash/in
@@ -0,0 +1,40 @@
+Lorem ipsum dolor sit amet consectetur adipisicing elit[1]. Maxime mollitia,
+molestiae quas vel sint commodi[2] repudiandae consequuntur voluptatum laborum
+numquam blanditiis harum quisquam eius sed odit fugiat iusto fuga praesentium
+optio, eaque rerum![3] Provident similique accusantium nemo autem. Veritatis
+obcaecati tenetur iure eius earum ut molestias architecto voluptate aliquam
+nihil,[4] eveniet aliquid culpa officia aut! Impedit sit sunt quaerat, odit,
+tenetur error, harum nesciunt ipsum debitis quas aliquid. Reprehenderit,
+quia. Quo neque error repudiandae fuga? Ipsa laudantium molestias eos 
+sapiente officiis modi at sunt excepturi expedita sint? Sed quibusdam
+recusandae alias error harum maxime adipisci amet laborum[5]. Perspiciatis 
+minima nesciunt dolorem! Officiis iure rerum voluptates a cumque velit 
+quibusdam sed amet tempora[6]. Sit laborum ab, eius fugit doloribus tenetur 
+fugiat, temporibus enim commodi iusto libero magni deleniti quod quam 
+consequuntur! Commodi minima excepturi repudiandae velit hic maxime
+doloremque[7]. Quaerat provident commodi consectetur veniam similique ad 
+earum omnis ipsum saepe, voluptas, hic voluptates pariatur est explicabo 
+fugiat, dolorum eligendi quam cupiditate excepturi mollitia maiores labore 
+suscipit quas? Nulla, placeat[8]. Voluptatem quaerat non architecto ab laudantium
+modi minima sunt esse temporibus sint culpa, recusandae aliquam numquam 
+totam ratione voluptas quod exercitationem fuga[9]. Possimus quis earum veniam 
+quasi aliquam eligendi, placeat qui corporis!
+
+
+[1] This is the first footnote.
+
+[2] This is the second footnote.
+
+[3] This is the third footnote.
+
+[4] This is the fourth footnote.
+
+[5] This is the fifth footnote.
+
+[6] This is the sixth footnote.
+
+[7] This is the seventh footnote.
+
+[8] This is the eighth footnote.
+
+[9] This is the Ninth footnote.