patch 8.1.0694: when using text props may free memory that is not allocated

Problem:    When using text props may free memory that is not allocated.
            (Andy Massimino)
Solution:   Allocate the line when adjusting text props. (closes #3766)

Author: brammool

src/textprop.c

@@ -979,15 +979,17 @@ adjust_prop_columns(
 	pt = text_prop_type_by_id(curbuf, tmp_prop.tp_type);
 
 	if (bytes_added > 0
-		? (tmp_prop.tp_col >= col + (pt != NULL && (pt->pt_flags & PT_FLAG_INS_START_INCL) ? 2 : 1))
+		? (tmp_prop.tp_col >= col
+		       + (pt != NULL && (pt->pt_flags & PT_FLAG_INS_START_INCL)
+								      ? 2 : 1))
 		: (tmp_prop.tp_col > col + 1))
 	{
 	    tmp_prop.tp_col += bytes_added;
 	    dirty = TRUE;
 	}
 	else if (tmp_prop.tp_len > 0
 		&& tmp_prop.tp_col + tmp_prop.tp_len > col
-			+ ((pt != NULL && (pt->pt_flags & PT_FLAG_INS_END_INCL))
+		       + ((pt != NULL && (pt->pt_flags & PT_FLAG_INS_END_INCL))
 								      ? 0 : 1))
 	{
 	    tmp_prop.tp_len += bytes_added;
@@ -1001,8 +1003,13 @@ adjust_prop_columns(
     }
     if (dirty)
     {
+	colnr_T newlen = (int)textlen + wi * (colnr_T)sizeof(textprop_T);
+
+	if ((curbuf->b_ml.ml_flags & ML_LINE_DIRTY) == 0)
+	    curbuf->b_ml.ml_line_ptr =
+				 vim_memsave(curbuf->b_ml.ml_line_ptr, newlen);
 	curbuf->b_ml.ml_flags |= ML_LINE_DIRTY;
-	curbuf->b_ml.ml_line_len = (int)textlen + wi * sizeof(textprop_T);
+	curbuf->b_ml.ml_line_len = newlen;
     }
 }
 

src/version.c

@@ -799,6 +799,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    694,
 /**/
     693,
 /**/