vim-patch:8.0.1416: crash when searching for a sentence

Problem:    Crash when searching for a sentence.
Solution:   Return NUL when getting character at MAXCOL. (closes vim/vim#2468)
https://github.com/vim/vim/commit/8ada6aa9298b4764d9ca0024dd21b17e815595ce

4 files changed, 20 insertions, 11 deletions

diff --git a/src/nvim/ex_docmd.c b/src/nvim/ex_docmd.c
index ac5de0733b..7c0e2afb0b 100644
--- a/src/nvim/ex_docmd.c
+++ b/src/nvim/ex_docmd.c
@@ -3665,13 +3665,14 @@ static linenr_T get_address(exarg_T *eap,
         if (lnum != MAXLNUM)
           curwin->w_cursor.lnum = lnum;
         /*
-         * Start a forward search at the end of the line.
+         * Start a forward search at the end of the line (unless
+         * before the first line).
          * Start a backward search at the start of the line.
          * This makes sure we never match in the current
          * line, and can match anywhere in the
          * next/previous line.
          */
-        if (c == '/')
+        if (c == '/' && curwin->w_cursor.lnum > 0)
           curwin->w_cursor.col = MAXCOL;
         else
           curwin->w_cursor.col = 0;
diff --git a/src/nvim/memline.c b/src/nvim/memline.c
index ec9996810f..a787e2f104 100644
--- a/src/nvim/memline.c
+++ b/src/nvim/memline.c
@@ -3999,18 +3999,15 @@ void goto_byte(long cnt)
 /// Return 0 otherwise.
 int inc(pos_T *lp)
 {
-  char_u  *p = ml_get_pos(lp);
-
-  if (*p != NUL) {      // still within line, move to next char (may be NUL)
-    if (has_mbyte) {
-      int l = (*mb_ptr2len)(p);
+  // when searching position may be set to end of a line
+  if (lp->col != MAXCOL) {
+    const char_u *const p = ml_get_pos(lp);
+    if (*p != NUL) {  // still within line, move to next char (may be NUL)
+      const int l = utfc_ptr2len(p);
 
       lp->col += l;
-      return (p[l] != NUL) ? 0 : 2;
+      return ((p[l] != NUL) ? 0 : 2);
     }
-    lp->col++;
-    lp->coladd = 0;
-    return (p[1] != NUL) ? 0 : 2;
   }
   if (lp->lnum != curbuf->b_ml.ml_line_count) {     // there is a next line
     lp->col = 0;
diff --git a/src/nvim/misc1.c b/src/nvim/misc1.c
index ad0a8d409f..99dc29f119 100644
--- a/src/nvim/misc1.c
+++ b/src/nvim/misc1.c
@@ -1752,6 +1752,10 @@ del_lines (
 
 int gchar_pos(pos_T *pos)
 {
+  // When searching columns is sometimes put at the end of a line.
+  if (pos->col == MAXCOL) {
+    return NUL;
+  }
   return utf_ptr2char(ml_get_pos(pos));
 }
 
diff --git a/src/nvim/testdir/test_search.vim b/src/nvim/testdir/test_search.vim
index 7663c9e283..6780fb0b44 100644
--- a/src/nvim/testdir/test_search.vim
+++ b/src/nvim/testdir/test_search.vim
@@ -480,3 +480,10 @@ func Test_look_behind()
   call search(getline("."))
   bwipe!
 endfunc
+
+func Test_search_sentence()
+  new
+  " this used to cause a crash
+  call assert_fails("/\\%'", 'E486')
+  call assert_fails("/", 'E486')
+endfunc