# HG changeset patch
# User Christian Brabandt <cb@256bit.org>
# Date 1712870103 -7200
# Node ID 58416c1d1b94f8614f7e9d9ec8b0251ffa98fa3a
# Parent  ce3e5cfe3e40113cb7eae597e330fca5772cfc4a
patch 9.1.0309: crash when 'textwidth' > MAX_INT

Commit: https://github.com/vim/vim/commit/bba79808cb115d4f54063e8aa40628a927eab44e
Author: Christian Brabandt <cb@256bit.org>
Date:   Thu Apr 11 22:54:44 2024 +0200

    patch 9.1.0309: crash when 'textwidth' > MAX_INT

    Problem:  crash when 'textwidth' > MAX_INT (after vv9.1.0055)
              (Zoltan Balogh)
    Solution: limit textwidth to MAX_INT

    fixes: #14482
    closes: #14489

    Signed-off-by: Christian Brabandt <cb@256bit.org>

diff --git a/src/testdir/test_textformat.vim b/src/testdir/test_textformat.vim
--- a/src/testdir/test_textformat.vim
+++ b/src/testdir/test_textformat.vim
@@ -1303,4 +1303,13 @@ func Test_correct_cursor_position()
   set encoding=utf8
 endfunc
 
+" This was crashing Vim
+func Test_textwdith_overflow()
+  new
+  setl tw=999999999
+  normal 10ig
+  call feedkeys('a ab cd ef', 'xt')
+  bw!
+endfunc
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/textformat.c b/src/textformat.c
--- a/src/textformat.c
+++ b/src/textformat.c
@@ -56,6 +56,7 @@ internal_format(
     colnr_T	leader_len;
     int		no_leader = FALSE;
     int		do_comments = (flags & INSCHAR_DO_COM);
+    int		safe_tw = trim_to_int(8 * (vimlong_T)textwidth);
 #ifdef FEAT_LINEBREAK
     int		has_lbr = curwin->w_p_lbr;
 
@@ -95,7 +96,7 @@ internal_format(
 	// Cursor is currently at the end of line. No need to format
 	// if line length is less than textwidth (8 * textwidth for
 	// utf safety)
-	if (curwin->w_cursor.col < 8 * textwidth)
+	if (curwin->w_cursor.col < safe_tw)
 	{
 	    virtcol = get_nolist_virtcol()
 		+ char2cells(c != NUL ? c : gchar_cursor());
@@ -156,8 +157,7 @@ internal_format(
 	// line to textwidth border every time for each line break.
 	//
 	// Ceil to 8 * textwidth to optimize.
-	curwin->w_cursor.col = startcol < 8 * textwidth ? startcol :
-	    8 * textwidth;
+	curwin->w_cursor.col = startcol < safe_tw ? startcol : safe_tw;
 
 	foundcol = 0;
 	skip_pos = 0;
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -705,6 +705,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    309,
+/**/
     308,
 /**/
     307,