Mercurial > vim
changeset 23762:0f89d58eb3e3 v8.2.2422
patch 8.2.2422: crash when deleting with line number out of range
Commit: https://github.com/vim/vim/commit/1d859e24218635c57c09801840ff159cb845ae6a
Author: Bram Moolenaar <Bram@vim.org>
Date: Thu Jan 28 17:24:58 2021 +0100
patch 8.2.2422: crash when deleting with line number out of range
Problem: Crash when deleting with line number out of range. (Houyunsong)
Solution: Avoid using a negative line number.
| author | Bram Moolenaar <Bram@vim.org> |
|---|---|
| date | Thu, 28 Jan 2021 17:30:04 +0100 |
| parents | bdfe3d59dde6 |
| children | 6408379c9328 |
| files | src/normal.c src/testdir/test_ex_mode.vim src/version.c |
| diffstat | 3 files changed, 23 insertions(+), 1 deletions(-) [+] |
line wrap: on
line diff
--- a/src/normal.c +++ b/src/normal.c @@ -630,7 +630,7 @@ getcount: } else ca.count0 = ca.count0 * 10 + (c - '0'); - if (ca.count0 < 0) // got too large! + if (ca.count0 < 0) // overflow ca.count0 = 999999999L; #ifdef FEAT_EVAL // Set v:count here, when called from main() and not a stuffed @@ -701,6 +701,8 @@ getcount: ca.count0 *= ca.opcount; else ca.count0 = ca.opcount; + if (ca.count0 < 0) // overflow + ca.count0 = 999999999L; } /* @@ -4775,6 +4777,8 @@ nv_percent(cmdarg_T *cap) else curwin->w_cursor.lnum = (curbuf->b_ml.ml_line_count * cap->count0 + 99L) / 100L; + if (curwin->w_cursor.lnum < 1) + curwin->w_cursor.lnum = 1; if (curwin->w_cursor.lnum > curbuf->b_ml.ml_line_count) curwin->w_cursor.lnum = curbuf->b_ml.ml_line_count; beginline(BL_SOL | BL_FIX);
--- a/src/testdir/test_ex_mode.vim +++ b/src/testdir/test_ex_mode.vim @@ -206,4 +206,20 @@ func Test_ex_mode_with_global() call delete('Xexmodescript') endfunc +func Test_ex_mode_count_overflow() + " this used to cause a crash + let lines =<< trim END + call feedkeys("\<Esc>Q\<CR>") + v9|9silent! vi|333333233333y32333333%O + call writefile(['done'], 'Xdidexmode') + qall! + END + call writefile(lines, 'Xexmodescript') + call assert_equal(1, RunVim([], [], '-e -s -S Xexmodescript -c qa')) + call assert_equal(['done'], readfile('Xdidexmode')) + + call delete('Xdidexmode') + call delete('Xexmodescript') +endfunc + " vim: shiftwidth=2 sts=2 expandtab