mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-10-02 16:08:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.0.0879: crash when shifting with huge number

Browse Source 
Problem:    Crash when shifting with huge number.
Solution:   Check for overflow. (Dominique Pelle, closes vim/vim#1945)
bae5a17a73
This commit is contained in:
Jan Edmund Lazo
2018-07-14 18:03:20 -04:00
parent 0e57c753d6
commit 7f2e352700
2 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/nvim/ops.c
View File

@@ -312,7 +312,6 @@ static void shift_block(oparg_T *oap, int amount)
{ {
int left = (oap->op_type == OP_LSHIFT); int left = (oap->op_type == OP_LSHIFT);
int oldstate = State; int oldstate = State;
int total;
char_u *newp, *oldp; char_u *newp, *oldp;
int oldcol = curwin->w_cursor.col; int oldcol = curwin->w_cursor.col;
int p_sw = get_sw_value(curbuf); int p_sw = get_sw_value(curbuf);
@@ -331,8 +330,12 @@ static void shift_block(oparg_T *oap, int amount)
if (bd.is_short) if (bd.is_short)
return; return;
/* total is number of screen columns to be inserted/removed */ // total is number of screen columns to be inserted/removed
total = amount * p_sw; int total = (int)((unsigned)amount * (unsigned)p_sw);
if ((total / p_sw) != amount) {
return; // multiplication overflow
}
oldp = get_cursor_line_ptr(); oldp = get_cursor_line_ptr();
if (!left) { if (!left) {

8
src/nvim/testdir/test_visual.vim
View File

@@ -17,6 +17,14 @@ func Test_block_shift_multibyte()
q! q!
endfunc endfunc
func Test_block_shift_overflow()
" This used to cause a multiplication overflow followed by a crash.
new
normal ii
exe "normal \<C-V>876543210>"
q!
endfunc
func Test_Visual_ctrl_o() func Test_Visual_ctrl_o()
new new
call setline(1, ['one', 'two', 'three']) call setline(1, ['one', 'two', 'three'])