diff options
| author | Bram Moolenaar <Bram@vim.org> | 2017-02-09 22:28:20 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2017-02-09 22:28:20 +0100 |
| commit | f1f6f3f7df2938b3583e341482d96c1d53124c51 (patch) | |
| tree | ff07d6af56fb33134bc736f4721e9c7f40667bfd | |
| parent | 31eb139b8877439d06db0ca57692dfe35fec3f0c (diff) | |
| download | vim-git-f1f6f3f7df2938b3583e341482d96c1d53124c51.tar.gz | |
patch 8.0.0324: illegal memory access with a wrong yank rangev8.0.0324
Problem: Illegal memory access with "1;y".
Solution: Call check_cursor() instead of check_cursor_lnum(). (Dominique
Pelle, closes #1455)
| -rw-r--r-- | src/ex_docmd.c | 4 | ||||
| -rw-r--r-- | src/testdir/test_cmdline.vim | 13 | ||||
| -rw-r--r-- | src/version.c | 2 |
3 files changed, 16 insertions, 3 deletions
diff --git a/src/ex_docmd.c b/src/ex_docmd.c index 3ee7056c1..09102b537 100644 --- a/src/ex_docmd.c +++ b/src/ex_docmd.c @@ -2295,8 +2295,8 @@ do_one_cmd( if (!ea.skip) { curwin->w_cursor.lnum = ea.line2; - /* don't leave the cursor on an illegal line */ - check_cursor_lnum(); + /* don't leave the cursor on an illegal line or column */ + check_cursor(); } } else if (*ea.cmd != ',') diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim index b2beb689b..05beb45c9 100644 --- a/src/testdir/test_cmdline.vim +++ b/src/testdir/test_cmdline.vim @@ -289,13 +289,24 @@ func Test_remove_char_in_cmdline() call assert_equal('"def', @:) endfunc -func Test_illegal_address() +func Test_illegal_address1() new 2;'( 2;') quit endfunc +func Test_illegal_address2() + call writefile(['c', 'x', ' x', '.', '1;y'], 'Xtest.vim') + new + source Xtest.vim + " Trigger calling validate_cursor() + diffsp Xtest.vim + quit! + bwipe! + call delete('Xtest.vim') +endfunc + func Test_cmdline_complete_wildoptions() help call feedkeys(":tag /\<c-a>\<c-b>\"\<cr>", 'tx') diff --git a/src/version.c b/src/version.c index a6dbe9946..d174d035d 100644 --- a/src/version.c +++ b/src/version.c @@ -765,6 +765,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ /**/ + 324, +/**/ 323, /**/ 322, |