patch 8.2.4108: going over the end of the w_lines arrayv8.2.4108

Problem:    Going over the end of the w_lines array.
Solution:   Check not going over the end and limit to Rows. (issue #9540)

1 files changed, 5 insertions, 2 deletions

diff --git a/src/drawscreen.c b/src/drawscreen.c
index e0fb122995..d03c429cc7 100644
--- a/src/drawscreen.c
+++ b/src/drawscreen.c
@@ -1815,10 +1815,11 @@ win_update(win_T *wp)
 	    // When topline didn't change, find first entry in w_lines[] that
 	    // needs updating.
 
-	    // try to find wp->w_topline in wp->w_lines[].wl_lnum
+	    // Try to find wp->w_topline in wp->w_lines[].wl_lnum.  The check
+	    // for "Rows" is in case "wl_size" is incorrect somehow.
 	    j = -1;
 	    row = 0;
-	    for (i = 0; i < wp->w_lines_valid; i++)
+	    for (i = 0; i < wp->w_lines_valid && i < Rows; i++)
 	    {
 		if (wp->w_lines[i].wl_valid
 			&& wp->w_lines[i].wl_lnum == wp->w_topline)
@@ -1848,6 +1849,8 @@ win_update(win_T *wp)
 		// ... but don't delete new filler lines.
 		row -= wp->w_topfill;
 #endif
+		if (row > Rows)  // just in case
+		    row = Rows;
 		if (row > 0)
 		{
 		    check_for_delay(FALSE);