# HG changeset patch # User Christian Brabandt # Date 1708541106 -3600 # Node ID 8b0e390b61fe8c7f2f6740b25f552b0a4769da3c # Parent e7a9e4b8cace7e4339bf75b0d0aeb9d5d24910d6 patch 9.1.0121: Infinite loop or signed overflow with 'smoothscroll' Commit: https://github.com/vim/vim/commit/02fcae02a926e4e8379d77fb716da4202029882d Author: Sean Dewar <6256228+seandewar@users.noreply.github.com> Date: Wed Feb 21 19:40:44 2024 +0100 patch 9.1.0121: Infinite loop or signed overflow with 'smoothscroll' Problem: infinite loop in win_update with 'smoothscroll' set when window width is equal to textoff, or signed integer overflow if smaller. Solution: don't revalidate wp->w_skipcol in that case, as no buffer text is being shown. (Sean Dewar) Don't instead reset w_skipcol; that would lose the scroll position within the line, which may be undesirable if the window is made wider later. Also include changes from the splitmove PR #14042 that I (in my infinite Git wisdom) forgot to commit. This includes a change to Test_window_split_no_room to ensure it doesn't fail for some screen sizes. Move Test_smoothscroll_in_zero_width_window to test_scroll_opt.vim, as that file feels more appropriate. closes: #14068 Signed-off-by: Sean Dewar <6256228+seandewar@users.noreply.github.com> Signed-off-by: Christian Brabandt diff --git a/src/drawscreen.c b/src/drawscreen.c --- a/src/drawscreen.c +++ b/src/drawscreen.c @@ -1537,7 +1537,7 @@ win_update(win_T *wp) // Make sure skipcol is valid, it depends on various options and the window // width. - if (wp->w_skipcol > 0) + if (wp->w_skipcol > 0 && wp->w_width > win_col_off(wp)) { int w = 0; int width1 = wp->w_width - win_col_off(wp); diff --git a/src/proto/window.pro b/src/proto/window.pro --- a/src/proto/window.pro +++ b/src/proto/window.pro @@ -28,7 +28,7 @@ void may_make_initial_scroll_size_snapsh void may_trigger_win_scrolled_resized(void); void win_close_othertab(win_T *win, int free_buf, tabpage_T *tp); void win_free_all(void); -win_T *winframe_remove(win_T *win, int *dirp, tabpage_T *tp, frame_T **to_flatten); +win_T *winframe_remove(win_T *win, int *dirp, tabpage_T *tp, frame_T **unflat_altfr); void close_others(int message, int forceit); void unuse_tabpage(tabpage_T *tp); void use_tabpage(tabpage_T *tp); diff --git a/src/testdir/test_scroll_opt.vim b/src/testdir/test_scroll_opt.vim --- a/src/testdir/test_scroll_opt.vim +++ b/src/testdir/test_scroll_opt.vim @@ -960,4 +960,42 @@ func Test_smoothscroll_insert_bottom() call StopVimInTerminal(buf) endfunc +func Test_smoothscroll_in_zero_width_window() + set cpo+=n number smoothscroll + set winwidth=99999 winminwidth=0 + + vsplit + call assert_equal(0, winwidth(winnr('#'))) + call win_execute(win_getid(winnr('#')), "norm! \") + + only! + set winwidth& winminwidth& + set cpo-=n nonumber nosmoothscroll +endfunc + +func Test_smoothscroll_textoff_small_winwidth() + set smoothscroll number + call setline(1, 'llanfairpwllgwyngyllgogerychwyrndrobwllllantysiliogogogoch') + vsplit + + let textoff = getwininfo(win_getid())[0].textoff + execute 'vertical resize' textoff + 1 + redraw + call assert_equal(0, winsaveview().skipcol) + execute "normal! 0\" + redraw + call assert_equal(1, winsaveview().skipcol) + execute 'vertical resize' textoff - 1 + " This caused a signed integer overflow. + redraw + call assert_equal(1, winsaveview().skipcol) + execute 'vertical resize' textoff + " This caused an infinite loop. + redraw + call assert_equal(1, winsaveview().skipcol) + + %bw! + set smoothscroll& number& +endfunc + " vim: shiftwidth=2 sts=2 expandtab diff --git a/src/testdir/test_window_cmd.vim b/src/testdir/test_window_cmd.vim --- a/src/testdir/test_window_cmd.vim +++ b/src/testdir/test_window_cmd.vim @@ -322,14 +322,18 @@ func Test_window_split_no_room() call assert_equal(restcmd, winrestcmd()) " Check that the last statusline isn't lost. - set laststatus=0 - let restcmd = winrestcmd() + " Set its window's width to 2 for the test. wincmd j + set laststatus=0 winminwidth=0 + vertical resize 2 + set winminwidth& call setwinvar(winnr('k'), '&statusline', '@#') let last_stl_row = win_screenpos(0)[0] - 1 redraw call assert_equal('@#|', GetScreenStr(last_stl_row)) call assert_equal('~ |', GetScreenStr(&lines - &cmdheight)) + + let restcmd = winrestcmd() call assert_fails('wincmd H', 'E36:') call assert_fails('wincmd L', 'E36:') call assert_equal(layout, winlayout()) @@ -2153,19 +2157,6 @@ func Test_new_help_window_on_error() call assert_equal(expand(""), "'mod'") endfunc -func Test_smoothscroll_in_zero_width_window() - set cpo+=n number smoothscroll - set winwidth=99999 winminwidth=0 - - vsplit - call assert_equal(0, winwidth(winnr('#'))) - call win_execute(win_getid(winnr('#')), "norm! \") - - only! - set winwidth& winminwidth& - set cpo-=n nonumber nosmoothscroll -endfunc - func Test_splitmove_flatten_frame() split vsplit @@ -2179,7 +2170,7 @@ func Test_splitmove_flatten_frame() only! endfunc -func Test_splitmove_autocmd_window_no_room() +func Test_autocmd_window_force_room() " Open as many windows as possible while v:true try @@ -2206,7 +2197,7 @@ func Test_splitmove_autocmd_window_no_ro edit unload me enew bunload! unload\ me - augroup SplitMoveAucmdWin + augroup AucmdWinForceRoom au! au BufEnter * ++once let s:triggered = v:true \| call assert_equal('autocmd', win_gettype()) @@ -2220,8 +2211,8 @@ func Test_splitmove_autocmd_window_no_ro call assert_equal(winrestcmd(), restcmd) unlet! s:triggered - au! SplitMoveAucmdWin - augroup! SplitMoveAucmdWin + au! AucmdWinForceRoom + augroup! AucmdWinForceRoom %bw! endfunc diff --git a/src/version.c b/src/version.c --- a/src/version.c +++ b/src/version.c @@ -705,6 +705,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 121, +/**/ 120, /**/ 119, diff --git a/src/window.c b/src/window.c --- a/src/window.c +++ b/src/window.c @@ -54,7 +54,7 @@ static void win_goto_hor(int left, long static void frame_add_height(frame_T *frp, int n); static void last_status_rec(frame_T *fr, int statusline); static void frame_flatten(frame_T *frp); -static void winframe_restore(win_T *wp, int dir, frame_T *to_flatten); +static void winframe_restore(win_T *wp, int dir, frame_T *unflat_altfr); static int make_snapshot_rec(frame_T *fr, frame_T **frp); static void clear_snapshot(tabpage_T *tp, int idx);