summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorBram Moolenaar <Bram@vim.org>2022-09-16 22:16:59 +0100
committerBram Moolenaar <Bram@vim.org>2022-09-16 22:16:59 +0100
commitc249913edc35c0e666d783bfc21595cf9f7d9e0d (patch)
tree802284966180f8dfcebe6e1a227d68a3ea41a943
parente24b4aba1fbf782954897abdbfc084c4221428eb (diff)
patch 9.0.0483: illegal memory access when replacing in virtualedit modev9.0.0483
Problem: Illegal memory access when replacing in virtualedit mode. Solution: Check for replacing NUL after Tab.
-rw-r--r--src/ops.c12
-rw-r--r--src/testdir/test_virtualedit.vim14
-rw-r--r--src/version.c2
3 files changed, 26 insertions, 2 deletions
diff --git a/src/ops.c b/src/ops.c
index 88d85f8e0b..99a5d5cdfd 100644
--- a/src/ops.c
+++ b/src/ops.c
@@ -1173,6 +1173,8 @@ op_replace(oparg_T *oap, int c)
while (LTOREQ_POS(curwin->w_cursor, oap->end))
{
+ int done = FALSE;
+
n = gchar_cursor();
if (n != NUL)
{
@@ -1186,6 +1188,7 @@ op_replace(oparg_T *oap, int c)
if (curwin->w_cursor.lnum == oap->end.lnum)
oap->end.col += new_byte_len - old_byte_len;
replace_character(c);
+ done = TRUE;
}
else
{
@@ -1204,10 +1207,15 @@ op_replace(oparg_T *oap, int c)
if (curwin->w_cursor.lnum == oap->end.lnum)
getvpos(&oap->end, end_vcol);
}
- PBYTE(curwin->w_cursor, c);
+ // with "coladd" set may move to just after a TAB
+ if (gchar_cursor() != NUL)
+ {
+ PBYTE(curwin->w_cursor, c);
+ done = TRUE;
+ }
}
}
- else if (virtual_op && curwin->w_cursor.lnum == oap->end.lnum)
+ if (!done && virtual_op && curwin->w_cursor.lnum == oap->end.lnum)
{
int virtcols = oap->end.coladd;
diff --git a/src/testdir/test_virtualedit.vim b/src/testdir/test_virtualedit.vim
index 8fd6d98447..8ca81a777d 100644
--- a/src/testdir/test_virtualedit.vim
+++ b/src/testdir/test_virtualedit.vim
@@ -572,4 +572,18 @@ func Test_virtualedit_mouse()
set virtualedit&
endfunc
+" this was replacing the NUL at the end of the line
+func Test_virtualedit_replace_after_tab()
+ new
+ s/\v/ 0
+ set ve=all
+ let @" = ''
+ sil! norm vPvr0
+
+ call assert_equal("\t0", getline(1))
+ set ve&
+ bwipe!
+endfunc
+
+
" vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 19f9e00ec9..8b6367ac93 100644
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 483,
+/**/
482,
/**/
481,