# HG changeset patch # User Christian Brabandt # Date 1501704905 -7200 # Node ID c9da7b42fdf5ad5906e305ab5d447324f52abfb4 # Parent 2f05821e4196eaea0cca061890b789564b76ceb6 patch 8.0.0841: term_getline() may cause a crash commit https://github.com/vim/vim/commit/5c838a3e7141f9950508c84439d2f959bc67e941 Author: Bram Moolenaar Date: Wed Aug 2 22:10:34 2017 +0200 patch 8.0.0841: term_getline() may cause a crash Problem: term_getline() may cause a crash. Solution: Check that the row is valid. (Hirohito Higashi) diff --git a/src/terminal.c b/src/terminal.c --- a/src/terminal.c +++ b/src/terminal.c @@ -1847,6 +1847,8 @@ f_term_getline(typval_T *argvars, typval int len; char_u *p; + if (row < 0 || row >= term->tl_rows) + return; len = term->tl_cols * MB_MAXBYTES + 1; p = alloc(len); if (p == NULL) diff --git a/src/testdir/test_terminal.vim b/src/testdir/test_terminal.vim --- a/src/testdir/test_terminal.vim +++ b/src/testdir/test_terminal.vim @@ -81,6 +81,10 @@ func Test_terminal_hide_buffer() endfunc func Check_123(buf) + let l = term_scrape(a:buf, 0) + call assert_true(len(l) == 0) + let l = term_scrape(a:buf, 999) + call assert_true(len(l) == 0) let l = term_scrape(a:buf, 1) call assert_true(len(l) > 0) call assert_equal('1', l[0].chars) @@ -93,6 +97,12 @@ func Check_123(buf) call assert_equal('#000000', l[0].bg) endif + let l = term_getline(a:buf, -1) + call assert_equal('', l) + let l = term_getline(a:buf, 0) + call assert_equal('', l) + let l = term_getline(a:buf, 999) + call assert_equal('', l) let l = term_getline(a:buf, 1) call assert_equal('123', l) endfunc diff --git a/src/version.c b/src/version.c --- a/src/version.c +++ b/src/version.c @@ -770,6 +770,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 841, +/**/ 840, /**/ 839,