Core was generated by `/home/runner/nvim-deps/usr/bin/luajit -e package.path="/home/runner/nvim-deps/u'.
    Program terminated with signal SIGSEGV, Segmentation fault.
    #0  0x00007f6ce220d25f in get_proto (L=L@entry=0x7f6ce22b1380) at src/cluacov/deepactivelines.c:136

    Thread 1 (LWP 34192):
    #0  0x00007f6ce220d25f in get_proto (L=L@entry=0x7f6ce22b1380) at src/cluacov/deepactivelines.c:136
    No locals.
    #1  0x00007f6ce220d3af in l_deepactivelines (L=0x7f6ce22b1380) at src/cluacov/deepactivelines.c:184
    No locals.
    #2  0x00005573d6e9ba6d in lj_BC_FUNCC ()
    No symbol table info available.
    #3  0x00005573d6e85dcd in lua_pcall (L=0x7f6ce22b1380, nargs=0, nresults=-1, errfunc=<optimized out>) at lj_api.c:1169
            g = 0x7f6ce22b13e0
            oldh = 0 '\000'
            ef = 40
            status = <optimized out>
            __func__ = "lua_pcall"
    #4  0x00005573d6e76b9b in docall (L=0x7f6ce22b1380, narg=0, clear=0) at luajit.c:121
            status = <optimized out>
            base = 2
    #5  0x00005573d6e77af2 in handle_script (argx=<optimized out>, L=0x7f6ce22b1380) at luajit.c:292
            narg = 0
            status = <optimized out>
            fname = <optimized out>
            status = <optimized out>
            fname = <optimized out>
            narg = <optimized out>
    #6  pmain (L=0x7f6ce22b1380) at luajit.c:553
            s = 0x5573d6f13030 <smain>
            argv = <optimized out>
            argn = <optimized out>
            flags = <optimized out>
    #7  0x00005573d6e9ba6d in lj_BC_FUNCC ()
    No symbol table info available.
    #8  0x00005573d6e85e91 in lua_cpcall (L=<optimized out>, func=<optimized out>, ud=<optimized out>) at lj_api.c:1197
            g = 0x7f6ce22b13e0
            oldh = 0 '\000'
            status = <optimized out>
            __func__ = "lua_cpcall"
    #9  0x00005573d6e766ba in main (argc=4, argv=0x7ffe62e8ca98) at luajit.c:582
            status = <optimized out>
            L = 0x7f6ce22b1380

    Core was generated by `/home/runner/nvim-deps/usr/bin/luajit -e package.path="/home/runner/nvim-deps/u'.
    Program terminated with signal SIGSEGV, Segmentation fault.
    #0  0x00007f6ce220d25f in get_proto (L=L@entry=0x7f6ce22b1380) at src/cluacov/deepactivelines.c:136

    Thread 1 (LWP 34192):
    #0  0x00007f6ce220d25f in get_proto (L=L@entry=0x7f6ce22b1380) at src/cluacov/deepactivelines.c:136
    No locals.
    #1  0x00007f6ce220d3af in l_deepactivelines (L=0x7f6ce22b1380) at src/cluacov/deepactivelines.c:184
    No locals.
    #2  0x00005573d6e9ba6d in lj_BC_FUNCC ()
    No symbol table info available.
    #3  0x00005573d6e85dcd in lua_pcall (L=0x7f6ce22b1380, nargs=0, nresults=-1, errfunc=<optimized out>) at lj_api.c:1169
            g = 0x7f6ce22b13e0
            oldh = 0 '\000'
            ef = 40
            status = <optimized out>
            __func__ = "lua_pcall"
    #4  0x00005573d6e76b9b in docall (L=0x7f6ce22b1380, narg=0, clear=0) at luajit.c:121
            status = <optimized out>
            base = 2
    #5  0x00005573d6e77af2 in handle_script (argx=<optimized out>, L=0x7f6ce22b1380) at luajit.c:292
            narg = 0
            status = <optimized out>
            fname = <optimized out>
            status = <optimized out>
            fname = <optimized out>
            narg = <optimized out>
    #6  pmain (L=0x7f6ce22b1380) at luajit.c:553
            s = 0x5573d6f13030 <smain>
            argv = <optimized out>
            argn = <optimized out>
            flags = <optimized out>
    #7  0x00005573d6e9ba6d in lj_BC_FUNCC ()
    No symbol table info available.
    #8  0x00005573d6e85e91 in lua_cpcall (L=<optimized out>, func=<optimized out>, ud=<optimized out>) at lj_api.c:1197
            g = 0x7f6ce22b13e0
            oldh = 0 '\000'
            status = <optimized out>
            __func__ = "lua_cpcall"
    #9  0x00005573d6e766ba in main (argc=4, argv=0x7ffe62e8ca98) at luajit.c:582
            status = <optimized out>
            L = 0x7f6ce22b1380

    Core was generated by `/home/runner/nvim-deps/usr/bin/luajit -e package.path="/home/runner/nvim-deps/u'.
    Program terminated with signal SIGSEGV, Segmentation fault.
    #0  0x00007f6ce220d25f in get_proto (L=L@entry=0x7f6ce22b1380) at src/cluacov/deepactivelines.c:136

    Thread 1 (LWP 34192):
    #0  0x00007f6ce220d25f in get_proto (L=L@entry=0x7f6ce22b1380) at src/cluacov/deepactivelines.c:136
    No locals.
    #1  0x00007f6ce220d3af in l_deepactivelines (L=0x7f6ce22b1380) at src/cluacov/deepactivelines.c:184
    No locals.
    #2  0x00005573d6e9ba6d in lj_BC_FUNCC ()
    No symbol table info available.
    #3  0x00005573d6e85dcd in lua_pcall (L=0x7f6ce22b1380, nargs=0, nresults=-1, errfunc=<optimized out>) at lj_api.c:1169
            g = 0x7f6ce22b13e0
            oldh = 0 '\000'
            ef = 40
            status = <optimized out>
            __func__ = "lua_pcall"
    #4  0x00005573d6e76b9b in docall (L=0x7f6ce22b1380, narg=0, clear=0) at luajit.c:121
            status = <optimized out>
            base = 2
    #5  0x00005573d6e77af2 in handle_script (argx=<optimized out>, L=0x7f6ce22b1380) at luajit.c:292
            narg = 0
            status = <optimized out>
            fname = <optimized out>
            status = <optimized out>
            fname = <optimized out>
            narg = <optimized out>
    #6  pmain (L=0x7f6ce22b1380) at luajit.c:553
            s = 0x5573d6f13030 <smain>
            argv = <optimized out>
            argn = <optimized out>
            flags = <optimized out>
    #7  0x00005573d6e9ba6d in lj_BC_FUNCC ()
    No symbol table info available.
    #8  0x00005573d6e85e91 in lua_cpcall (L=<optimized out>, func=<optimized out>, ud=<optimized out>) at lj_api.c:1197
            g = 0x7f6ce22b13e0
            oldh = 0 '\000'
            status = <optimized out>
            __func__ = "lua_cpcall"
    #9  0x00005573d6e766ba in main (argc=4, argv=0x7ffe62e8ca98) at luajit.c:582
            status = <optimized out>
            L = 0x7f6ce22b1380

Problem
-------

In neovim#19040, I reported two things that started happening somewhen in the
last three months when using neovim in hterm (the Chrome Secure Shell
terminal):

 1. Under certain circumstances, the window title (set by nvim
    [i0]) would appear over the line I was typing, corrupting the screen.
 2. If I changed my $TERM from xterm-256color to the new hterm-256color
    (available since ncurses >=20210320), the window title corruption
    was gone, but pane scrolling was broken.

Both problems are due to changes in the termcap files, their source of
truth being the ncurses project. See "Timeline of ncurses changes" below
for details.

Cause: title corruption
-----------------------

The title corruption when using hterm + TERM=xterm-256color can be
explained by event #4 (ncurses 2022-03-12) in the ncurses timeline:

The xterm-256color termcap file gained status line termcodes in ncurses
2022-03-12. These termcodes are used by Neovim to set the title when.
hterm does not have a status line. Due to ncurses versions earlier than
2022-03-12 missing the xterm status line capability, Neovim manually
fixed up [t0] the terminfo file if $TERM was xterm-256color. So if
before Neovim manually added fsl/tsl capabilties, and after they were
in the termcap file, why did hterm suddenly start getting corruption?
The answer is that the termcodes for these capabilties are different
when Neovim fixes them up, versus the one in the new termcap database:

   fsl=\E[0$}                  // from xterm-256color
   tsl=\E[2$~\E[1$}\E[%i%p1%d` // from xterm-256color

   fsl=\x07                    // patched by Neovim
   tsl=\x1b]0;                 // patched by Neovim

hterm ignores the latter, but corrupts the screen with the former.

Solution: Make hterm users set hterm-256color, which lacks the new
fsl/tsl codes. Also, to reduce superfluous work, stop patching in this
capability when hterm is detected (even if hterm would ignore the
patched version).

Cause: pane corruption
----------------------

The pane corruption when using hterm + TERM=hterm-256color, but NOT when
using hterm + TERM=xterm-256color can be explained by:

 - Neovim uses DECSLRM when available [p1] for performant scrolling.
 - Both the hterm-256color and xterm-256color termcap databases
   advertise support for DECSLRM (ncurses timeline #1, #2 and #3).
 - hterm does not support DESCLRM [p2] (note: it does support DESCTBM for
   top/bottom scrolling, but it's broken [p3] and not used by Neovim)
 - xterm-alikes that are not real xterm generally don't support DECSLRM
   either, so Neovim patches it out [p4].

When using hterm-256color, hterm is no longer considered an xterm-alike
by Neovim. As a result, DECSLRM is not cleared. hterm does not support
it, so corruption ensues.

This is a problem with the hterm-256color termcap file, but we're stuck
with it so the best we can do is patch over it.

Timeline of ncurses changes
---------------------------

 1. 2019-05-19: Part of the DECSLRM capability (smglr AKA set_lr_margin)
    added to vt420+lrmm, which xterm-256color inherits [n1]
 2. 2021-03-20: hterm-256color added, inheriting xterm-256colors. [n2]
 3. 2021-09-25: The *parm versions of smglr (AKA set_lr_margin) were
    added to vt420+lrmm [n3]. Namely:
     1. smglp AKA set_left_margin_parm, and
     2. smgrp AKA set_right_margin_parm
 4. 2022-03-12: (new) codes for fsl, bsl and tsl added to xterm (add
    dec+sl to xterm-new, per patch neovim#371 -TD) [n4]

Fixes neovim#19040.

[i0]: https://github.com/neovim/neovim/blob/3a4fa22badc5595afc0a994ead965ff32ccf6c76/src/nvim/tui/tui.c#L1377
[t0]: https://github.com/neovim/neovim/blob/3a4fa22badc5595afc0a994ead965ff32ccf6c76/src/nvim/tui/tui.c#L1728,L1729
[p1]: https://github.com/neovim/neovim/blob/3a4fa22badc5595afc0a994ead965ff32ccf6c76/src/nvim/tui/tui.c#L1196
[p2]: https://bugs.chromium.org/p/chromium/issues/detail?id=1175065&q=component%3APlatform%3EApps%3EDefault%3EHterm
[p3]: https://bugs.chromium.org/p/chromium/issues/detail?id=1298796&q=component%3APlatform%3EApps%3EDefault%3EHterm
[p4]: https://github.com/neovim/neovim/blob/3a4fa22badc5595afc0a994ead965ff32ccf6c76/src/nvim/tui/tui.c#L1740-L1752
[n1]: mirror/ncurses@8f6d94b#diff-01544c577762d3308a1d232aa7afc79acf64b9a5057f88a004df82fda89549b7R2742
[n2]: mirror/ncurses@c265010#diff-01544c577762d3308a1d232aa7afc79acf64b9a5057f88a004df82fda89549b7R5907
[n3]: mirror/ncurses@f6b436c#diff-01544c577762d3308a1d232aa7afc79acf64b9a5057f88a004df82fda89549b7R2842
[n4]: mirror/ncurses@8bf8c83#diff-01544c577762d3308a1d232aa7afc79acf64b9a5057f88a004df82fda89549b7R4828

Signed-off-by: Nicolas Hillegeer <nicolas@hillegeer.com>

fix(usercmd): fix buffer overflow in uc_list()

Build with: -Wp,-D_FORTIFY_SOURCE=3 -O1 and gcc 13.

*** buffer overflow detected ***: terminated

(gdb) bt
  #0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
  #1  0x00007f3eb8b93c03 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78
  #2  0x00007f3eb8b42aee in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
  #3  0x00007f3eb8b2b87f in __GI_abort () at abort.c:79
  #4  0x00007f3eb8b2c60f in __libc_message (fmt=fmt@entry=0x7f3eb8ca72e6 "*** %s ***: terminated\n") at ../sysdeps/posix/libc_fatal.c:150
  #5  0x00007f3eb8c27b29 in __GI___fortify_fail (msg=msg@entry=0x7f3eb8ca728c "buffer overflow detected") at fortify_fail.c:24
  #6  0x00007f3eb8c26364 in __GI___chk_fail () at chk_fail.c:28
  #7  0x00007f3eb8c25f45 in ___snprintf_chk (s=s@entry=0x55b8c7c096a5 <IObuff+5> "t' item", maxlen=maxlen@entry=1025, flag=flag@entry=2, slen=slen@entry=1020, format=format@entry=0x55b8c7b872a6 "%ldc") at snprintf_chk.c:29
  #8  0x000055b8c7aea59f in snprintf (__fmt=0x55b8c7b872a6 "%ldc", __n=1025, __s=0x55b8c7c096a5 <IObuff+5> "t' item") at /usr/include/bits/stdio2.h:54
  #9  uc_list (name=name@entry=0x55b8c8351788 "Explore", name_len=name_len@entry=7) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/usercmd.c:534
  #10 0x000055b8c7aeb8a0 in ex_command (eap=0x7fffdc350e60) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/usercmd.c:1009
  #11 0x000055b8c7972537 in execute_cmd0 (retv=retv@entry=0x7fffdc350e54, eap=eap@entry=0x7fffdc350e60, errormsg=errormsg@entry=0x7fffdc350e58, preview=preview@entry=false) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:1620
  #12 0x000055b8c7975c55 in do_one_cmd (cmdlinep=cmdlinep@entry=0x7fffdc3510b8, flags=flags@entry=0, cstack=cstack@entry=0x7fffdc351140, fgetline=fgetline@entry=0x55b8c79882b8 <getexline>, cookie=cookie@entry=0x0) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:2279
  #13 0x000055b8c79767fe in do_cmdline (cmdline=<optimized out>, fgetline=0x55b8c79882b8 <getexline>, cookie=0x0, flags=0) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:578
  #14 0x000055b8c7a17463 in nv_colon (cap=0x7fffdc351780) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:3228
  #15 0x000055b8c7a11b35 in normal_execute (state=0x7fffdc351700, key=<optimized out>) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:1196
  #16 0x000055b8c7ab0994 in state_enter (s=0x7fffdc351700) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/state.c:99
  #17 0x000055b8c7a0ef68 in normal_enter (cmdwin=false, noexmode=false) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:497
  neovim#18 0x000055b8c78a0640 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/main.c:641

Build with: -Wp,-D_FORTIFY_SOURCE=3 -O1 and gcc 13.

*** buffer overflow detected ***: terminated

(gdb) bt
  #0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
  #1  0x00007f3eb8b93c03 in __pthread_kill_internal (signo=6, threadid=<optimized out>) at pthread_kill.c:78
  #2  0x00007f3eb8b42aee in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
  #3  0x00007f3eb8b2b87f in __GI_abort () at abort.c:79
  #4  0x00007f3eb8b2c60f in __libc_message (fmt=fmt@entry=0x7f3eb8ca72e6 "*** %s ***: terminated\n") at ../sysdeps/posix/libc_fatal.c:150
  #5  0x00007f3eb8c27b29 in __GI___fortify_fail (msg=msg@entry=0x7f3eb8ca728c "buffer overflow detected") at fortify_fail.c:24
  #6  0x00007f3eb8c26364 in __GI___chk_fail () at chk_fail.c:28
  #7  0x00007f3eb8c25f45 in ___snprintf_chk (s=s@entry=0x55b8c7c096a5 <IObuff+5> "t' item", maxlen=maxlen@entry=1025, flag=flag@entry=2, slen=slen@entry=1020, format=format@entry=0x55b8c7b872a6 "%ldc") at snprintf_chk.c:29
  #8  0x000055b8c7aea59f in snprintf (__fmt=0x55b8c7b872a6 "%ldc", __n=1025, __s=0x55b8c7c096a5 <IObuff+5> "t' item") at /usr/include/bits/stdio2.h:54
  #9  uc_list (name=name@entry=0x55b8c8351788 "Explore", name_len=name_len@entry=7) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/usercmd.c:534
  #10 0x000055b8c7aeb8a0 in ex_command (eap=0x7fffdc350e60) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/usercmd.c:1009
  #11 0x000055b8c7972537 in execute_cmd0 (retv=retv@entry=0x7fffdc350e54, eap=eap@entry=0x7fffdc350e60, errormsg=errormsg@entry=0x7fffdc350e58, preview=preview@entry=false) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:1620
  #12 0x000055b8c7975c55 in do_one_cmd (cmdlinep=cmdlinep@entry=0x7fffdc3510b8, flags=flags@entry=0, cstack=cstack@entry=0x7fffdc351140, fgetline=fgetline@entry=0x55b8c79882b8 <getexline>, cookie=cookie@entry=0x0) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:2279
  #13 0x000055b8c79767fe in do_cmdline (cmdline=<optimized out>, fgetline=0x55b8c79882b8 <getexline>, cookie=0x0, flags=0) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/ex_docmd.c:578
  #14 0x000055b8c7a17463 in nv_colon (cap=0x7fffdc351780) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:3228
  #15 0x000055b8c7a11b35 in normal_execute (state=0x7fffdc351700, key=<optimized out>) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:1196
  #16 0x000055b8c7ab0994 in state_enter (s=0x7fffdc351700) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/state.c:99
  #17 0x000055b8c7a0ef68 in normal_enter (cmdwin=false, noexmode=false) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/normal.c:497
  neovim#18 0x000055b8c78a0640 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/neovim-0.9.0-1.fc38.x86_64/src/nvim/main.c:641