Permalink
Browse files

patch 7.4.2326

Problem:    Illegal memory access when Visual selection starts in invalid
            position. (Dominique Pelle)
Solution:   Correct position when needed.
  • Loading branch information...
1 parent 30180b8 commit d5824ce1b5491df7d2eb0b66189d366fa67b4585 @brammool brammool committed Sep 4, 2016
Showing with 28 additions and 0 deletions.
  1. +22 −0 src/misc2.c
  2. +3 −0 src/normal.c
  3. +1 −0 src/proto/misc2.pro
  4. +2 −0 src/version.c
View
@@ -505,6 +505,28 @@ get_cursor_rel_lnum(
}
/*
+ * Make sure "pos.lnum" and "pos.col" are valid in "buf".
+ * This allows for the col to be on the NUL byte.
+ */
+ void
+check_pos(buf_T *buf, pos_T *pos)
+{
+ char_u *line;
+ colnr_T len;
+
+ if (pos->lnum > buf->b_ml.ml_line_count)
+ pos->lnum = buf->b_ml.ml_line_count;
+
+ if (pos->col > 0)
+ {
+ line = ml_get_buf(buf, pos->lnum, FALSE);
+ len = (colnr_T)STRLEN(line);
+ if (pos->col > len)
+ pos->col = len;
+ }
+}
+
+/*
* Make sure curwin->w_cursor.lnum is valid.
*/
void
View
@@ -9451,7 +9451,10 @@ get_op_vcol(
#ifdef FEAT_MBYTE
/* prevent from moving onto a trail byte */
if (has_mbyte)
+ {
+ check_pos(curwin->w_buffer, &oap->end);
mb_adjustpos(curwin->w_buffer, &oap->end);
+ }
#endif
getvvcol(curwin, &(oap->start), &oap->start_vcol, NULL, &oap->end_vcol);
View
@@ -12,6 +12,7 @@ int dec_cursor(void);
int dec(pos_T *lp);
int decl(pos_T *lp);
linenr_T get_cursor_rel_lnum(win_T *wp, linenr_T lnum);
+void check_pos(buf_T *buf, pos_T *pos);
void check_cursor_lnum(void);
void check_cursor_col(void);
void check_cursor_col_win(win_T *win);
View
@@ -764,6 +764,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 2326,
+/**/
2325,
/**/
2324,

0 comments on commit d5824ce

Please sign in to comment.