From 8ada6aa9298b4764d9ca0024dd21b17e815595ce Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Tue, 19 Dec 2017 21:23:21 +0100
Subject: patch 8.0.1416: crash when searching for a sentence

Problem:    Crash when searching for a sentence.
Solution:   Return NUL when getting character at MAXCOL. (closes #2468)
---
 src/ex_docmd.c              |  5 +++--
 src/misc1.c                 |  6 +++++-
 src/misc2.c                 | 27 ++++++++++++++++-----------
 src/testdir/test_search.vim |  7 +++++++
 src/version.c               |  2 ++
 5 files changed, 33 insertions(+), 14 deletions(-)

diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index 84a72e112..539e39fb4 100644
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -4521,13 +4521,14 @@ get_address(
 		    if (lnum != MAXLNUM)
 			curwin->w_cursor.lnum = lnum;
 		    /*
-		     * Start a forward search at the end of the line.
+		     * Start a forward search at the end of the line (unless
+		     * before the first line).
 		     * Start a backward search at the start of the line.
 		     * This makes sure we never match in the current
 		     * line, and can match anywhere in the
 		     * next/previous line.
 		     */
-		    if (c == '/')
+		    if (c == '/' && curwin->w_cursor.lnum > 0)
 			curwin->w_cursor.col = MAXCOL;
 		    else
 			curwin->w_cursor.col = 0;
diff --git a/src/misc1.c b/src/misc1.c
index 4c691bb25..2d635d677 100644
--- a/src/misc1.c
+++ b/src/misc1.c
@@ -2650,8 +2650,12 @@ del_lines(
     int
 gchar_pos(pos_T *pos)
 {
-    char_u	*ptr = ml_get_pos(pos);
+    char_u	*ptr;
 
+    /* When searching columns is sometimes put at the end of a line. */
+    if (pos->col == MAXCOL)
+	return NUL;
+    ptr = ml_get_pos(pos);
 #ifdef FEAT_MBYTE
     if (has_mbyte)
 	return (*mb_ptr2char)(ptr);
diff --git a/src/misc2.c b/src/misc2.c
index 87b79fae1..fd432cdba 100644
--- a/src/misc2.c
+++ b/src/misc2.c
@@ -348,24 +348,29 @@ inc_cursor(void)
     int
 inc(pos_T *lp)
 {
-    char_u  *p = ml_get_pos(lp);
+    char_u  *p;
 
-    if (*p != NUL)	/* still within line, move to next char (may be NUL) */
+    /* when searching position may be set to end of a line */
+    if (lp->col != MAXCOL)
     {
-#ifdef FEAT_MBYTE
-	if (has_mbyte)
+	p = ml_get_pos(lp);
+	if (*p != NUL)	/* still within line, move to next char (may be NUL) */
 	{
-	    int l = (*mb_ptr2len)(p);
+#ifdef FEAT_MBYTE
+	    if (has_mbyte)
+	    {
+		int l = (*mb_ptr2len)(p);
 
-	    lp->col += l;
-	    return ((p[l] != NUL) ? 0 : 2);
-	}
+		lp->col += l;
+		return ((p[l] != NUL) ? 0 : 2);
+	    }
 #endif
-	lp->col++;
+	    lp->col++;
 #ifdef FEAT_VIRTUALEDIT
-	lp->coladd = 0;
+	    lp->coladd = 0;
 #endif
-	return ((p[1] != NUL) ? 0 : 2);
+	    return ((p[1] != NUL) ? 0 : 2);
+	}
     }
     if (lp->lnum != curbuf->b_ml.ml_line_count)     /* there is a next line */
     {
diff --git a/src/testdir/test_search.vim b/src/testdir/test_search.vim
index cb65fbf0b..84edfbbd4 100644
--- a/src/testdir/test_search.vim
+++ b/src/testdir/test_search.vim
@@ -729,3 +729,10 @@ func Test_look_behind()
   call search(getline("."))
   bwipe!
 endfunc
+
+func Test_search_sentence()
+  new
+  " this used to cause a crash
+  call assert_fails("/\\%'", 'E486')
+  call assert_fails("/", 'E486')
+endfunc
diff --git a/src/version.c b/src/version.c
index 7b2f89a77..11ff6038e 100644
--- a/src/version.c
+++ b/src/version.c
@@ -771,6 +771,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1416,
 /**/
     1415,
 /**/
-- 
cgit v1.2.1