mirrors/neovim
1
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-09-12 14:28:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.2.0120: virtcol() does not check arguments to be valid

Browse Source 
Problem:    virtcol() does not check arguments to be valid, which may lead to
            a crash.
Solution:   Check the column to be valid.  Do not decrement MAXCOL.
            (closes vim/vim#5480)
b3d33d8570
This commit is contained in:
Jan Edmund Lazo
2020-01-15 22:20:21 -05:00
parent 03da3697a4
commit d811fab0ad
2 changed files with 29 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/nvim/eval.c
View File

@@ -16018,7 +16018,7 @@ static void f_setpos(typval_T *argvars, typval_T *rettv, FunPtr fptr)
const char *const name = tv_get_string_chk(argvars);
if (name != NULL) {
if (list2fpos(&argvars[1], &pos, &fnum, &curswant) == OK) {
if (--pos.col < 0) {
if (pos.col != MAXCOL && --pos.col < 0) {
pos.col = 0;
}
if (name[0] == '.' && name[1] == NUL) {
@@ -19045,6 +19045,15 @@ static void f_virtcol(typval_T *argvars, typval_T *rettv, FunPtr fptr)
fp = var2fpos(&argvars[0], FALSE, &fnum);
if (fp != NULL && fp->lnum <= curbuf->b_ml.ml_line_count
&& fnum == curbuf->b_fnum) {
// Limit the column to a valid value, getvvcol() doesn't check.
if (fp->col < 0) {
fp->col = 0;
} else {
const size_t len = STRLEN(ml_get(fp->lnum));
if (fp->col > (colnr_T)len) {
fp->col = (colnr_T)len;
}
}
getvvcol(curwin, fp, NULL, NULL, &vcol);
++vcol;
}

21
src/nvim/testdir/test_marks.vim
View File

@@ -26,11 +26,11 @@ function! Test_Incr_Marks()
endfunction
func Test_setpos()
new one
new Xone
let onebuf = bufnr('%')
let onewin = win_getid()
call setline(1, ['aaa', 'bbb', 'ccc'])
new two
new Xtwo
let twobuf = bufnr('%')
let twowin = win_getid()
call setline(1, ['aaa', 'bbb', 'ccc'])
@@ -63,7 +63,24 @@ func Test_setpos()
call setpos("'N", [onebuf, 1, 3, 0])
call assert_equal([onebuf, 1, 3, 0], getpos("'N"))
" try invalid column and check virtcol()
call win_gotoid(onewin)
call setpos("'a", [0, 1, 2, 0])
call assert_equal([0, 1, 2, 0], getpos("'a"))
call setpos("'a", [0, 1, -5, 0])
call assert_equal([0, 1, 2, 0], getpos("'a"))
call setpos("'a", [0, 1, 0, 0])
call assert_equal([0, 1, 1, 0], getpos("'a"))
call setpos("'a", [0, 1, 4, 0])
call assert_equal([0, 1, 4, 0], getpos("'a"))
call assert_equal(4, virtcol("'a"))
call setpos("'a", [0, 1, 5, 0])
call assert_equal([0, 1, 5, 0], getpos("'a"))
call assert_equal(4, virtcol("'a"))
call setpos("'a", [0, 1, 21341234, 0])
call assert_equal([0, 1, 21341234, 0], getpos("'a"))
call assert_equal(4, virtcol("'a"))
bwipe!
call win_gotoid(twowin)
bwipe!