# HG changeset patch
# User Bram Moolenaar <Bram@vim.org>
# Date 1660230003 -7200
# Node ID 5b3a8860131734dc77f5814a7e0a0e67171701b0
# Parent  0e09dde486f6bf6ba84bbe6b82a01290281aceb3
patch 9.0.0192: possible invalid memory access when 'cmdheight' is zero

Commit: https://github.com/vim/vim/commit/fdc5d17d58cc9c9edc9fb2816e1afaabc531bf1e
Author: Bram Moolenaar <Bram@vim.org>
Date:   Thu Aug 11 15:52:14 2022 +0100

    patch 9.0.0192: possible invalid memory access when 'cmdheight' is zero

    Problem:    Possible invalid memory access when 'cmdheight' is zero. (Martin
                Tournoij)
    Solution:   Avoid going over the end of w_lines[] when w_height is Rows.
                (closes #10882)

diff --git a/src/drawscreen.c b/src/drawscreen.c
--- a/src/drawscreen.c
+++ b/src/drawscreen.c
@@ -1808,9 +1808,13 @@ win_update(win_T *wp)
 
 			    // Move the entries that were scrolled, disable
 			    // the entries for the lines to be redrawn.
+			    // Avoid using a wrong index when 'cmdheight' is
+			    // zero and wp->w_height == Rows.
 			    if ((wp->w_lines_valid += j) > wp->w_height)
 				wp->w_lines_valid = wp->w_height;
-			    for (idx = wp->w_lines_valid; idx - j >= 0; idx--)
+			    for (idx = wp->w_lines_valid >= wp->w_height
+				    ? wp->w_height - 1 : wp->w_lines_valid;
+							   idx - j >= 0; idx--)
 				wp->w_lines[idx] = wp->w_lines[idx - j];
 			    while (idx >= 0)
 				wp->w_lines[idx--].wl_valid = FALSE;
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -736,6 +736,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    192,
+/**/
     191,
 /**/
     190,