diff options
| author | Bram Moolenaar <Bram@vim.org> | 2020-07-15 17:38:21 +0200 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2020-07-15 17:38:21 +0200 |
| commit | 452143c6bf0dcf76ef415281b0e4fbc3edff4b6b (patch) | |
| tree | 153921e2b1e64e647edff3aa33709c5ac197c5f9 /src/mouse.c | |
| parent | 5966ea105ea86e52a734e04267956e11efffc92d (diff) | |
| download | vim-git-452143c6bf0dcf76ef415281b0e4fbc3edff4b6b.tar.gz | |
patch 8.2.1220: memory access error when dragging a popup windowv8.2.1220
Problem: memory access error when dragging a popup window over a buffer
with folding.
Solution: Avoid going over the end of the cache. (closes #6438)
Diffstat (limited to 'src/mouse.c')
| -rw-r--r-- | src/mouse.c | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/src/mouse.c b/src/mouse.c index 095417e35..56472a3f0 100644 --- a/src/mouse.c +++ b/src/mouse.c @@ -2839,10 +2839,10 @@ check_termcode_mouse( /* * Compute the buffer line position from the screen position "rowp" / "colp" in * window "win". - * "plines_cache" can be NULL (no cache) or an array with "win->w_height" - * entries that caches the plines_win() result from a previous call. Entry is - * zero if not computed yet. There must be no text or setting changes since - * the entry is put in the cache. + * "plines_cache" can be NULL (no cache) or an array with "Rows" entries that + * caches the plines_win() result from a previous call. Entry is zero if not + * computed yet. There must be no text or setting changes since the entry is + * put in the cache. * Returns TRUE if the position is below the last line. */ int @@ -2871,7 +2871,10 @@ mouse_comp_pos( { int cache_idx = lnum - win->w_topline; - if (plines_cache != NULL && plines_cache[cache_idx] > 0) + // Only "Rows" lines are cached, with folding we'll run out of entries + // and use the slow way. + if (plines_cache != NULL && cache_idx < Rows + && plines_cache[cache_idx] > 0) count = plines_cache[cache_idx]; else { @@ -2892,7 +2895,7 @@ mouse_comp_pos( else #endif count = plines_win(win, lnum, TRUE); - if (plines_cache != NULL) + if (plines_cache != NULL && cache_idx < Rows) plines_cache[cache_idx] = count; } if (count > row) |