diff options
| author | Bram Moolenaar <Bram@vim.org> | 2020-01-15 20:36:55 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2020-01-15 20:36:55 +0100 |
| commit | b3d33d8570bc49a7f90990572d7f9630a1bfae02 (patch) | |
| tree | 46c3d7dedbb64129504f404d5dfdb2bfb7ec2ecc /src/evalfunc.c | |
| parent | 1470dc35c4b14bda1995b7566c9a41a33eb06517 (diff) | |
| download | vim-git-b3d33d8570bc49a7f90990572d7f9630a1bfae02.tar.gz | |
patch 8.2.0120: virtcol() does not check arguments to be validv8.2.0120
Problem: virtcol() does not check arguments to be valid, which may lead to
a crash.
Solution: Check the column to be valid. Do not decrement MAXCOL.
(closes #5480)
Diffstat (limited to 'src/evalfunc.c')
| -rw-r--r-- | src/evalfunc.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/src/evalfunc.c b/src/evalfunc.c index 4465fc07c..d248f4bf4 100644 --- a/src/evalfunc.c +++ b/src/evalfunc.c @@ -6605,7 +6605,7 @@ f_setpos(typval_T *argvars, typval_T *rettv) { if (list2fpos(&argvars[1], &pos, &fnum, &curswant) == OK) { - if (--pos.col < 0) + if (pos.col != MAXCOL && --pos.col < 0) pos.col = 0; if (name[0] == '.' && name[1] == NUL) { @@ -8372,11 +8372,21 @@ f_virtcol(typval_T *argvars, typval_T *rettv) colnr_T vcol = 0; pos_T *fp; int fnum = curbuf->b_fnum; + int len; fp = var2fpos(&argvars[0], FALSE, &fnum); if (fp != NULL && fp->lnum <= curbuf->b_ml.ml_line_count && fnum == curbuf->b_fnum) { + // Limit the column to a valid value, getvvcol() doesn't check. + if (fp->col < 0) + fp->col = 0; + else + { + len = (int)STRLEN(ml_get(fp->lnum)); + if (fp->col > len) + fp->col = len; + } getvvcol(curwin, fp, NULL, NULL, &vcol); ++vcol; } |