Mercurial > vim
changeset 29704:5b3a88601317 v9.0.0192
patch 9.0.0192: possible invalid memory access when 'cmdheight' is zero
Commit: https://github.com/vim/vim/commit/fdc5d17d58cc9c9edc9fb2816e1afaabc531bf1e
Author: Bram Moolenaar <Bram@vim.org>
Date: Thu Aug 11 15:52:14 2022 +0100
patch 9.0.0192: possible invalid memory access when 'cmdheight' is zero
Problem: Possible invalid memory access when 'cmdheight' is zero. (Martin
Tournoij)
Solution: Avoid going over the end of w_lines[] when w_height is Rows.
(closes #10882)
| author | Bram Moolenaar <Bram@vim.org> |
|---|---|
| date | Thu, 11 Aug 2022 17:00:03 +0200 |
| parents | 0e09dde486f6 |
| children | a347400a24a9 |
| files | src/drawscreen.c src/version.c |
| diffstat | 2 files changed, 7 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/src/drawscreen.c +++ b/src/drawscreen.c @@ -1808,9 +1808,13 @@ win_update(win_T *wp) // Move the entries that were scrolled, disable // the entries for the lines to be redrawn. + // Avoid using a wrong index when 'cmdheight' is + // zero and wp->w_height == Rows. if ((wp->w_lines_valid += j) > wp->w_height) wp->w_lines_valid = wp->w_height; - for (idx = wp->w_lines_valid; idx - j >= 0; idx--) + for (idx = wp->w_lines_valid >= wp->w_height + ? wp->w_height - 1 : wp->w_lines_valid; + idx - j >= 0; idx--) wp->w_lines[idx] = wp->w_lines[idx - j]; while (idx >= 0) wp->w_lines[idx--].wl_valid = FALSE;