changeset 27154:6d7fe3af5aa2 v8.2.4106

patch 8.2.4106: going over the end of the w_lines array Commit: https://github.com/vim/vim/commit/fa1a45705995f16ee7e69434c772107a3ddeeebd Author: Bram Moolenaar <Bram@vim.org> Date: Sun Jan 16 11:42:20 2022 +0000 patch 8.2.4106: going over the end of the w_lines array Problem: Going over the end of the w_lines array. Solution: Break out of the loop when "idx" is too big. (issue https://github.com/vim/vim/issues/9540)
author Bram Moolenaar <Bram@vim.org>
date Sun, 16 Jan 2022 12:45:03 +0100
parents ebd3d5313ea6
children 1ebb45dd9232
files src/drawscreen.c src/version.c
diffstat 2 files changed, 7 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/src/drawscreen.c
+++ b/src/drawscreen.c
@@ -2539,6 +2539,11 @@ win_update(win_T *wp)
 	    eof = TRUE;
 	    break;
 	}
+
+	// Safety check: if any of the wl_size values is wrong we might go over
+	// the end of w_lines[].
+	if (idx >= Rows)
+	    break;
     }
 
     // End of loop over all window lines.
--- a/src/version.c
+++ b/src/version.c
@@ -751,6 +751,8 @@ static char *(features[]) =
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    4106,
+/**/
     4105,
 /**/
     4104,