diff options
| author | Bram Moolenaar <Bram@vim.org> | 2017-11-26 16:53:16 +0100 |
|---|---|---|
| committer | Bram Moolenaar <Bram@vim.org> | 2017-11-26 16:53:16 +0100 |
| commit | a3571ebef5a2969d16e3e202ec4bca8858aca6ba (patch) | |
| tree | e3fa434b1f473c4fd5d1167ee0ff4a343eae1c2e /src/popupmnu.c | |
| parent | c41838aa01ef99540e2737c42e9b1283e3da5e26 (diff) | |
| download | vim-git-a3571ebef5a2969d16e3e202ec4bca8858aca6ba.tar.gz | |
patch 8.0.1346: crash when passing 50 char string to balloon_split()v8.0.1346
Problem: Crash when passing 50 char string to balloon_split().
Solution: Fix off-by-one error.
Diffstat (limited to 'src/popupmnu.c')
| -rw-r--r-- | src/popupmnu.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/popupmnu.c b/src/popupmnu.c index 77460a1a6..447f789e5 100644 --- a/src/popupmnu.c +++ b/src/popupmnu.c @@ -836,7 +836,7 @@ split_message(char_u *mesg, pumitem_T **array) item->bytelen = p - item->start; if (item->cells > max_cells) max_cells = item->cells; - long_item_count += item->cells / BALLOON_MIN_WIDTH; + long_item_count += (item->cells - 1) / BALLOON_MIN_WIDTH; } height = 2 + ga.ga_len; |