# HG changeset patch
# User Christian Brabandt <cb@256bit.org>
# Date 1513683005 -3600
# Node ID 50aa6da392cea003a09923758044ac7f2082fdbb
# Parent  40e1f60f4eeb5a68bcf32114e50981d20e5b172c
patch 8.0.1411: reading invalid memory with CTRL-W :

commit https://github.com/vim/vim/commit/2efb323e875d2852f63e41c40641760d1d6b069f
Author: Bram Moolenaar <Bram@vim.org>
Date:   Tue Dec 19 12:27:23 2017 +0100

    patch 8.0.1411: reading invalid memory with CTRL-W :

    Problem:    Reading invalid memory with CTRL-W :.
    Solution:   Correct the command characters. (closes https://github.com/vim/vim/issues/2469)

diff --git a/src/normal.c b/src/normal.c
--- a/src/normal.c
+++ b/src/normal.c
@@ -7850,8 +7850,12 @@ n_start_visual_mode(int c)
 nv_window(cmdarg_T *cap)
 {
     if (cap->nchar == ':')
+    {
 	/* "CTRL-W :" is the same as typing ":"; useful in a terminal window */
+	cap->cmdchar = ':';
+	cap->nchar = NUL;
 	nv_colon(cap);
+    }
     else if (!checkclearop(cap->oap))
 	do_window(cap->nchar, cap->count0, NUL); /* everything is in window.c */
 }
diff --git a/src/ops.c b/src/ops.c
--- a/src/ops.c
+++ b/src/ops.c
@@ -183,8 +183,15 @@ get_op_type(int char1, int char2)
     if (char1 == 'g' && char2 == Ctrl_X)	/* subtract */
 	return OP_NR_SUB;
     for (i = 0; ; ++i)
+    {
 	if (opchars[i][0] == char1 && opchars[i][1] == char2)
 	    break;
+	if (i == (int)(sizeof(opchars) / sizeof(char [3]) - 1))
+	{
+	    internal_error("get_op_type()");
+	    break;
+	}
+    }
     return i;
 }
 
diff --git a/src/testdir/test_window_cmd.vim b/src/testdir/test_window_cmd.vim
--- a/src/testdir/test_window_cmd.vim
+++ b/src/testdir/test_window_cmd.vim
@@ -467,4 +467,9 @@ func Test_window_contents()
   call test_garbagecollect_now()
 endfunc
 
+func Test_window_colon_command()
+  " This was reading invalid memory.
+  exe "norm! v\<C-W>:\<C-U>echo v:version"
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -772,6 +772,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1411,
+/**/
     1410,
 /**/
     1409,