# HG changeset patch
# User Bram Moolenaar <Bram@vim.org>
# Date 1611851404 -3600
# Node ID 0f89d58eb3e31f1b92a9dc9686cccb13553a59cd
# Parent  bdfe3d59dde6022d6bf3615ea4b9210c4481a6cd
patch 8.2.2422: crash when deleting with line number out of range

Commit: https://github.com/vim/vim/commit/1d859e24218635c57c09801840ff159cb845ae6a
Author: Bram Moolenaar <Bram@vim.org>
Date:   Thu Jan 28 17:24:58 2021 +0100

    patch 8.2.2422: crash when deleting with line number out of range

    Problem:    Crash when deleting with line number out of range. (Houyunsong)
    Solution:   Avoid using a negative line number.

diff --git a/src/normal.c b/src/normal.c
--- a/src/normal.c
+++ b/src/normal.c
@@ -630,7 +630,7 @@ getcount:
 	    }
 	    else
 		ca.count0 = ca.count0 * 10 + (c - '0');
-	    if (ca.count0 < 0)	    // got too large!
+	    if (ca.count0 < 0)	    // overflow
 		ca.count0 = 999999999L;
 #ifdef FEAT_EVAL
 	    // Set v:count here, when called from main() and not a stuffed
@@ -701,6 +701,8 @@ getcount:
 	    ca.count0 *= ca.opcount;
 	else
 	    ca.count0 = ca.opcount;
+	if (ca.count0 < 0)	    // overflow
+	    ca.count0 = 999999999L;
     }
 
     /*
@@ -4775,6 +4777,8 @@ nv_percent(cmdarg_T *cap)
 	    else
 		curwin->w_cursor.lnum = (curbuf->b_ml.ml_line_count *
 						    cap->count0 + 99L) / 100L;
+	    if (curwin->w_cursor.lnum < 1)
+		curwin->w_cursor.lnum = 1;
 	    if (curwin->w_cursor.lnum > curbuf->b_ml.ml_line_count)
 		curwin->w_cursor.lnum = curbuf->b_ml.ml_line_count;
 	    beginline(BL_SOL | BL_FIX);
diff --git a/src/testdir/test_ex_mode.vim b/src/testdir/test_ex_mode.vim
--- a/src/testdir/test_ex_mode.vim
+++ b/src/testdir/test_ex_mode.vim
@@ -206,4 +206,20 @@ func Test_ex_mode_with_global()
   call delete('Xexmodescript')
 endfunc
 
+func Test_ex_mode_count_overflow()
+  " this used to cause a crash
+  let lines =<< trim END
+    call feedkeys("\<Esc>Q\<CR>")
+    v9|9silent! vi|333333233333y32333333%O
+    call writefile(['done'], 'Xdidexmode')
+    qall!
+  END
+  call writefile(lines, 'Xexmodescript')
+  call assert_equal(1, RunVim([], [], '-e -s -S Xexmodescript -c qa'))
+  call assert_equal(['done'], readfile('Xdidexmode'))
+
+  call delete('Xdidexmode')
+  call delete('Xexmodescript')
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -751,6 +751,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    2422,
+/**/
     2421,
 /**/
     2420,