Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
patch 9.0.0483: illegal memory access when replacing in virtualedit mode
Problem:    Illegal memory access when replacing in virtualedit mode.
Solution:   Check for replacing NUL after Tab.
  • Loading branch information
brammool committed Sep 16, 2022
1 parent e24b4ab commit c249913
Show file tree
Hide file tree
Showing 3 changed files with 26 additions and 2 deletions.
12 changes: 10 additions & 2 deletions src/ops.c
Expand Up @@ -1173,6 +1173,8 @@ op_replace(oparg_T *oap, int c)

while (LTOREQ_POS(curwin->w_cursor, oap->end))
{
int done = FALSE;

n = gchar_cursor();
if (n != NUL)
{
Expand All @@ -1186,6 +1188,7 @@ op_replace(oparg_T *oap, int c)
if (curwin->w_cursor.lnum == oap->end.lnum)
oap->end.col += new_byte_len - old_byte_len;
replace_character(c);
done = TRUE;
}
else
{
Expand All @@ -1204,10 +1207,15 @@ op_replace(oparg_T *oap, int c)
if (curwin->w_cursor.lnum == oap->end.lnum)
getvpos(&oap->end, end_vcol);
}
PBYTE(curwin->w_cursor, c);
// with "coladd" set may move to just after a TAB
if (gchar_cursor() != NUL)
{
PBYTE(curwin->w_cursor, c);
done = TRUE;
}
}
}
else if (virtual_op && curwin->w_cursor.lnum == oap->end.lnum)
if (!done && virtual_op && curwin->w_cursor.lnum == oap->end.lnum)
{
int virtcols = oap->end.coladd;

Expand Down
14 changes: 14 additions & 0 deletions src/testdir/test_virtualedit.vim
Expand Up @@ -572,4 +572,18 @@ func Test_virtualedit_mouse()
set virtualedit&
endfunc
" this was replacing the NUL at the end of the line
func Test_virtualedit_replace_after_tab()
new
s/\v/ 0
set ve=all
let @" = ''
sil! norm vPvr0
call assert_equal("\t0", getline(1))
set ve&
bwipe!
endfunc
" vim: shiftwidth=2 sts=2 expandtab
2 changes: 2 additions & 0 deletions src/version.c
Expand Up @@ -703,6 +703,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
/**/
483,
/**/
482,
/**/
Expand Down

0 comments on commit c249913

Please sign in to comment.