Skip to content

Commit

Permalink
patch 9.0.2107: [security]: FPE in adjust_plines_for_skipcol
Browse files Browse the repository at this point in the history
Problem:  [security]: FPE in adjust_plines_for_skipcol
Solution: don't divide by zero, return zero

Prevent a floating point exception when calculating w_skipcol (which can
happen with a small window when the number option is set and cpo+=n).

Add a test to verify

Signed-off-by: Christian Brabandt <cb@256bit.org>
  • Loading branch information
chrisbra committed Nov 16, 2023
1 parent 25aabc2 commit cb0b99f
Show file tree
Hide file tree
Showing 3 changed files with 24 additions and 2 deletions.
5 changes: 3 additions & 2 deletions src/move.c
Expand Up @@ -45,8 +45,9 @@ adjust_plines_for_skipcol(win_T *wp)
return 0;

int width = wp->w_width - win_col_off(wp);
if (wp->w_skipcol >= width)
return (wp->w_skipcol - width) / (width + win_col_off2(wp)) + 1;
int w2 = width + win_col_off2(wp);
if (wp->w_skipcol >= width && w2 > 0)
return (wp->w_skipcol - width) / w2 + 1;

return 0;
}
Expand Down
19 changes: 19 additions & 0 deletions src/testdir/test_scroll_opt.vim
Expand Up @@ -926,4 +926,23 @@ func Test_smoothscroll_cursor_top()
call StopVimInTerminal(buf)
endfunc

" Division by zero, shouldn't crash
func Test_smoothscroll_crash()
CheckScreendump

let lines =<< trim END
20 new
vsp
put =repeat('aaaa', 20)
set nu fdc=1 smoothscroll cpo+=n
vert resize 0
exe "norm! 0\<c-e>"
END
call writefile(lines, 'XSmoothScrollCrash', 'D')
let buf = RunVimInTerminal('-u NONE -S XSmoothScrollCrash', #{rows: 12, cols:40})
call term_sendkeys(buf, "2\<C-E>\<C-L>")

call StopVimInTerminal(buf)
endfunc

" vim: shiftwidth=2 sts=2 expandtab
2 changes: 2 additions & 0 deletions src/version.c
Expand Up @@ -704,6 +704,8 @@ static char *(features[]) =

static int included_patches[] =
{ /* Add new patch number below this line */
/**/
2107,
/**/
2106,
/**/
Expand Down

0 comments on commit cb0b99f

Please sign in to comment.