diff options
| author | Bram Moolenaar <Bram@vim.org> | 2020-01-15 20:36:55 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2020-01-15 20:36:55 +0100 |
| commit | b3d33d8570bc49a7f90990572d7f9630a1bfae02 (patch) | |
| tree | 46c3d7dedbb64129504f404d5dfdb2bfb7ec2ecc | |
| parent | 1470dc35c4b14bda1995b7566c9a41a33eb06517 (diff) | |
patch 8.2.0120: virtcol() does not check arguments to be validv8.2.0120
Problem: virtcol() does not check arguments to be valid, which may lead to
a crash.
Solution: Check the column to be valid. Do not decrement MAXCOL.
(closes #5480)
| -rw-r--r-- | src/evalfunc.c | 12 | ||||
| -rw-r--r-- | src/testdir/test_marks.vim | 21 | ||||
| -rw-r--r-- | src/version.c | 2 |
3 files changed, 32 insertions, 3 deletions
diff --git a/src/evalfunc.c b/src/evalfunc.c index 4465fc07c1..d248f4bf42 100644 --- a/src/evalfunc.c +++ b/src/evalfunc.c @@ -6605,7 +6605,7 @@ f_setpos(typval_T *argvars, typval_T *rettv) { if (list2fpos(&argvars[1], &pos, &fnum, &curswant) == OK) { - if (--pos.col < 0) + if (pos.col != MAXCOL && --pos.col < 0) pos.col = 0; if (name[0] == '.' && name[1] == NUL) { @@ -8372,11 +8372,21 @@ f_virtcol(typval_T *argvars, typval_T *rettv) colnr_T vcol = 0; pos_T *fp; int fnum = curbuf->b_fnum; + int len; fp = var2fpos(&argvars[0], FALSE, &fnum); if (fp != NULL && fp->lnum <= curbuf->b_ml.ml_line_count && fnum == curbuf->b_fnum) { + // Limit the column to a valid value, getvvcol() doesn't check. + if (fp->col < 0) + fp->col = 0; + else + { + len = (int)STRLEN(ml_get(fp->lnum)); + if (fp->col > len) + fp->col = len; + } getvvcol(curwin, fp, NULL, NULL, &vcol); ++vcol; } diff --git a/src/testdir/test_marks.vim b/src/testdir/test_marks.vim index 3d04c70aa6..829f40dcbd 100644 --- a/src/testdir/test_marks.vim +++ b/src/testdir/test_marks.vim @@ -26,11 +26,11 @@ func Test_Incr_Marks() endfunc func Test_setpos() - new one + new Xone let onebuf = bufnr('%') let onewin = win_getid() call setline(1, ['aaa', 'bbb', 'ccc']) - new two + new Xtwo let twobuf = bufnr('%') let twowin = win_getid() call setline(1, ['aaa', 'bbb', 'ccc']) @@ -63,7 +63,24 @@ func Test_setpos() call setpos("'N", [onebuf, 1, 3, 0]) call assert_equal([onebuf, 1, 3, 0], getpos("'N")) + " try invalid column and check virtcol() call win_gotoid(onewin) + call setpos("'a", [0, 1, 2, 0]) + call assert_equal([0, 1, 2, 0], getpos("'a")) + call setpos("'a", [0, 1, -5, 0]) + call assert_equal([0, 1, 2, 0], getpos("'a")) + call setpos("'a", [0, 1, 0, 0]) + call assert_equal([0, 1, 1, 0], getpos("'a")) + call setpos("'a", [0, 1, 4, 0]) + call assert_equal([0, 1, 4, 0], getpos("'a")) + call assert_equal(4, virtcol("'a")) + call setpos("'a", [0, 1, 5, 0]) + call assert_equal([0, 1, 5, 0], getpos("'a")) + call assert_equal(4, virtcol("'a")) + call setpos("'a", [0, 1, 21341234, 0]) + call assert_equal([0, 1, 21341234, 0], getpos("'a")) + call assert_equal(4, virtcol("'a")) + bwipe! call win_gotoid(twowin) bwipe! diff --git a/src/version.c b/src/version.c index 44bfd6bc32..e20bf5d243 100644 --- a/src/version.c +++ b/src/version.c @@ -743,6 +743,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 120, +/**/ 119, /**/ 118, |