Repository: neovim
Issue: TUI: segfault when using extmark with very long URL
Labels: tui,bug-crash

### Problem

TUI segfaults when using extmark with very long URL. ASAN log:
```
=================================================================
==280569==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x531000012630 at pc 0x5b8b676bd084 bp 0x7ffc40542f10 sp 0x7ffc405426d0
WRITE of size 100019 at 0x531000012630 thread T0
    #0 0x5b8b676bd083 in __asan_memcpy (**/build/bin/nvim+0xd29083) (BuildId: 51d9302e21cef8c7d563cf75b16d50cc87897e8c)
    #1 0x5b8b68c04bf8 in out **/src/nvim/tui/tui.c:1844:3
    #2 0x5b8b68c183ed in update_attrs **/src/nvim/tui/tui.c:815:7
    #3 0x5b8b68c22b8b in print_cell **/src/nvim/tui/tui.c:855:3
    #4 0x5b8b68c1f833 in print_cell_at_pos **/src/nvim/tui/tui.c:1038:3
    #5 0x5b8b68c25769 in tui_raw_line **/src/nvim/tui/tui.c:1672:3
    #6 0x5b8b68c63a1c in ui_client_event_raw_line **/src/nvim/ui_client.c:275:3
    #7 0x5b8b6848b009 in parse_msgpack **/src/nvim/msgpack_rpc/channel.c:251:11
    #8 0x5b8b68480c71 in receive_msgpack **/src/nvim/msgpack_rpc/channel.c:213:5
    #9 0x5b8b67e28fbc in read_event **/src/nvim/event/rstream.c:180:23
    #10 0x5b8b67e2898d in invoke_read_cb **/src/nvim/event/rstream.c:232:3
    #11 0x5b8b67e25b9d in read_cb **/src/nvim/event/rstream.c:135:3
    #12 0x5b8b690a424a in uv__read **/.deps/build/src/libuv/src/unix/stream.c:1148:7
    #13 0x5b8b690a1b7c in uv__stream_io **/.deps/build/src/libuv/src/unix/stream.c:1208:5
    #14 0x5b8b690adcd1 in uv__io_poll **/.deps/build/src/libuv/src/unix/linux.c:1570:11
    #15 0x5b8b6908f405 in uv_run **/.deps/build/src/libuv/src/unix/core.c:458:5
    #16 0x5b8b67e12cd9 in loop_uv_run **/src/nvim/event/loop.c:61:3
    #17 0x5b8b67e128e4 in loop_poll_events **/src/nvim/event/loop.c:82:26
    #18 0x5b8b68c61ac9 in ui_client_run **/src/nvim/ui_client.c:176:5
    #19 0x5b8b681fef6d in main **/src/nvim/main.c:354:5
    #20 0x7c8dc1170e07 in __libc_start_call_main /usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #21 0x7c8dc1170ecb in __libc_start_main /usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:360:3
    #22 0x5b8b675d4d24 in _start (**/build/bin/nvim+0xc40d24) (BuildId: 51d9302e21cef8c7d563cf75b16d50cc87897e8c)

0x531000012630 is located 0 bytes after 73264-byte region [0x531000000800,0x531000012630)
allocated by thread T0 here:
    #0 0x5b8b676c1149 in calloc (**/build/bin/nvim+0xd2d149) (BuildId: 51d9302e21cef8c7d563cf75b16d50cc87897e8c)
    #1 0x5b8b683c473d in xcalloc **/src/nvim/memory.c:159:15
    #2 0x5b8b68c012d2 in tui_start **/src/nvim/tui/tui.c:164:18
    #3 0x5b8b68c6194b in ui_client_run **/src/nvim/ui_client.c:163:3
    #4 0x5b8b681fef6d in main **/src/nvim/main.c:354:5
    #5 0x7c8dc1170e07 in __libc_start_call_main /usr/src/debug/glibc/glibc/csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #6 0x7c8dc1170ecb in __libc_start_main /usr/src/debug/glibc/glibc/csu/../csu/libc-start.c:360:3
    #7 0x5b8b675d4d24 in _start (**/build/bin/nvim+0xc40d24) (BuildId: 51d9302e21cef8c7d563cf75b16d50cc87897e8c)

SUMMARY: AddressSanitizer: heap-buffer-overflow (**/build/bin/nvim+0xd29083) (BuildId: 51d9302e21cef8c7d563cf75b16d50cc87897e8c) in __asan_memcpy
Shadow bytes around the buggy address:
  0x531000012380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x531000012400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x531000012480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x531000012500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x531000012580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x531000012600: 00 00 00 00 00 00[fa]fa fa fa fa fa fa fa fa fa
  0x531000012680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x531000012700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x531000012780: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x531000012800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x531000012880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
==280569==ABORTING
```

### Steps to reproduce

1. Run `nvim --clean`
2. Source the following Lua file:
```lua
local ns = vim.api.nvim_create_namespace('test')
vim.api.nvim_buf_set_lines(0, 0, -1, true, { 'foobar' })
vim.api.nvim_buf_set_extmark(0, ns, 0, 0, { end_col = 3, url = ('a'):rep(99999) })
```
3. Segfault

### Expected behavior

No segfault

### Nvim version (nvim -v)

v0.11.0-dev-965+gfb74fd2954

### Vim (not Nvim) behaves the same?

N/A

### Operating system/version

Arch Linux

### Terminal name/version

kitty 0.36.4

### $TERM environment variable

xterm-kitty

### Installation

build from repo