Fix use-after-free in fold tags when top line folded then new top line inserted.

In SparseVector, string inserted at start then NULL inserted at start.

3 files changed, 17 insertions, 1 deletions

diff --git a/doc/ScintillaHistory.html b/doc/ScintillaHistory.html
index 391049331..655e8489f 100644
--- a/doc/ScintillaHistory.html
+++ b/doc/ScintillaHistory.html
@@ -555,6 +555,9 @@
 	For IMEs, do not clear selected text when there is no composition text to show.
 	</li>
 	<li>
+	Fix to crash with fold tags where line inserted at start.
+	</li>
+	<li>
 	Fix to stream selection mode when moving caret up or down.
 	<a href="http://sourceforge.net/p/scintilla/bugs/1905/">Bug #1905</a>.
 	</li>
diff --git a/src/SparseVector.h b/src/SparseVector.h
index f96b36b8b..20fa56cca 100644
--- a/src/SparseVector.h
+++ b/src/SparseVector.h
@@ -100,7 +100,8 @@ public:
 			if (partition == 0) {
 				// Inserting at start of document so ensure 0
 				if (valueCurrent != T()) {
-					ClearValue(0);
+					// Since valueCurrent is needed again, should not ClearValue
+					values->SetValueAt(0, T());
 					starts->InsertPartition(1, 0);
 					values->InsertValue(1, 1, valueCurrent);
 					starts->InsertText(0, insertLength);
diff --git a/test/unit/testSparseVector.cxx b/test/unit/testSparseVector.cxx
index 11960163e..e0db7d094 100644
--- a/test/unit/testSparseVector.cxx
+++ b/test/unit/testSparseVector.cxx
@@ -89,6 +89,18 @@ TEST_CASE("SparseVector") {
 		st.Check();
 	}
 
+	SECTION("InsertStringAtStartThenInsertSpaceAtStart") {
+		REQUIRE(1 == st.Elements());
+		st.InsertSpace(0, 5);
+		st.SetValueAt(0, "3");
+		REQUIRE(1 == st.Elements());
+		REQUIRE("3----" == Representation(st));
+		st.InsertSpace(0, 1);
+		REQUIRE(2 == st.Elements());
+		REQUIRE("-3----" == Representation(st));
+		st.Check();
+	}
+
 	SECTION("InsertAndDeleteAtEnd") {
 		REQUIRE(1 == st.Elements());
 		st.InsertSpace(0, 5);