diff options
| author | Christian Brabandt <cb@256bit.org> | 2023-11-14 20:05:59 +0100 |
|---|---|---|
| committer | Christian Brabandt <cb@256bit.org> | 2023-11-16 22:04:37 +0100 |
| commit | cb0b99f0672d8446585d26e998343dceca17d1ce (patch) | |
| tree | 3cba6fe840cd98102776409e60a69ae0a24246aa | |
| parent | 25aabc2b8ee1e19ced6f4da9d866cf9378fc4c5a (diff) | |
patch 9.0.2107: [security]: FPE in adjust_plines_for_skipcolv9.0.2107
Problem: [security]: FPE in adjust_plines_for_skipcol
Solution: don't divide by zero, return zero
Prevent a floating point exception when calculating w_skipcol (which can
happen with a small window when the number option is set and cpo+=n).
Add a test to verify
Signed-off-by: Christian Brabandt <cb@256bit.org>
| -rw-r--r-- | src/move.c | 5 | ||||
| -rw-r--r-- | src/testdir/test_scroll_opt.vim | 19 | ||||
| -rw-r--r-- | src/version.c | 2 |
3 files changed, 24 insertions, 2 deletions
diff --git a/src/move.c b/src/move.c index ce06dc3394..fbb352a32e 100644 --- a/src/move.c +++ b/src/move.c @@ -45,8 +45,9 @@ adjust_plines_for_skipcol(win_T *wp) return 0; int width = wp->w_width - win_col_off(wp); - if (wp->w_skipcol >= width) - return (wp->w_skipcol - width) / (width + win_col_off2(wp)) + 1; + int w2 = width + win_col_off2(wp); + if (wp->w_skipcol >= width && w2 > 0) + return (wp->w_skipcol - width) / w2 + 1; return 0; } diff --git a/src/testdir/test_scroll_opt.vim b/src/testdir/test_scroll_opt.vim index d5d08a24c2..342d382c20 100644 --- a/src/testdir/test_scroll_opt.vim +++ b/src/testdir/test_scroll_opt.vim @@ -926,4 +926,23 @@ func Test_smoothscroll_cursor_top() call StopVimInTerminal(buf) endfunc +" Division by zero, shouldn't crash +func Test_smoothscroll_crash() + CheckScreendump + + let lines =<< trim END + 20 new + vsp + put =repeat('aaaa', 20) + set nu fdc=1 smoothscroll cpo+=n + vert resize 0 + exe "norm! 0\<c-e>" + END + call writefile(lines, 'XSmoothScrollCrash', 'D') + let buf = RunVimInTerminal('-u NONE -S XSmoothScrollCrash', #{rows: 12, cols:40}) + call term_sendkeys(buf, "2\<C-E>\<C-L>") + + call StopVimInTerminal(buf) +endfunc + " vim: shiftwidth=2 sts=2 expandtab diff --git a/src/version.c b/src/version.c index ec021985f2..684f3acf4c 100644 --- a/src/version.c +++ b/src/version.c @@ -705,6 +705,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 2107, +/**/ 2106, /**/ 2105, |