# HG changeset patch
# User Bram Moolenaar <Bram@vim.org>
# Date 1683567003 -7200
# Node ID b1dcb60b1e6c04d4aa452ef279d0c10d323a5c09
# Parent  a13ad773812926f5938fe309a60ad1eb4e74b58b
patch 9.0.1527: crash when using negative value for term_cols

Commit: https://github.com/vim/vim/commit/c28e7a2b2f23dbd246a1ad7ad7aaa6f7ab2e5887
Author: Kenta Sato <tosainu.maple@gmail.com>
Date:   Mon May 8 18:26:03 2023 +0100

    patch 9.0.1527: crash when using negative value for term_cols

    Problem:    Crash when using negative value for term_cols.
    Solution:   Check for invalid term_cols value. (Kenta Sato, closes https://github.com/vim/vim/issues/12362)

diff --git a/src/job.c b/src/job.c
--- a/src/job.c
+++ b/src/job.c
@@ -272,7 +272,8 @@ get_job_options(typval_T *tv, jobopt_T *
 		*lp = tv_get_number(item);
 		if (*lp < 0)
 		{
-		    semsg(_(e_invalid_value_for_argument_str_str), hi->hi_key, tv_get_string(item));
+		    semsg(_(e_invalid_value_for_argument_str_str),
+					      hi->hi_key, tv_get_string(item));
 		    return FAIL;
 		}
 	    }
@@ -444,10 +445,19 @@ get_job_options(typval_T *tv, jobopt_T *
 	    }
 	    else if (STRCMP(hi->hi_key, "term_cols") == 0)
 	    {
+		int error = FALSE;
+
 		if (!(supported2 & JO2_TERM_COLS))
 		    break;
 		opt->jo_set2 |= JO2_TERM_COLS;
-		opt->jo_term_cols = tv_get_number(item);
+		opt->jo_term_cols = tv_get_number_chk(item, &error);
+		if (error)
+		    return FAIL;
+		if (opt->jo_term_cols < 0 || opt->jo_term_cols > 1000)
+		{
+		    semsg(_(e_invalid_value_for_argument_str), "term_cols");
+		    return FAIL;
+		}
 	    }
 	    else if (STRCMP(hi->hi_key, "vertical") == 0)
 	    {
diff --git a/src/testdir/test_terminal.vim b/src/testdir/test_terminal.vim
--- a/src/testdir/test_terminal.vim
+++ b/src/testdir/test_terminal.vim
@@ -617,6 +617,10 @@ func Test_terminal_size()
   call assert_fails("call term_start(cmd, {'term_rows': 1001})", 'E475:')
   call assert_fails("call term_start(cmd, {'term_rows': 10.0})", 'E805:')
 
+  call assert_fails("call term_start(cmd, {'term_cols': -1})", 'E475:')
+  call assert_fails("call term_start(cmd, {'term_cols': 1001})", 'E475:')
+  call assert_fails("call term_start(cmd, {'term_cols': 10.0})", 'E805:')
+
   call delete('Xtext')
 endfunc
 
diff --git a/src/version.c b/src/version.c
--- a/src/version.c
+++ b/src/version.c
@@ -696,6 +696,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1527,
+/**/
     1526,
 /**/
     1525,