diff options
| author | zeertzjq <zeertzjq@outlook.com> | 2025-02-24 11:20:37 +0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-02-24 11:20:37 +0800 |
| commit | 01236c3bfeba90a254de75ec720543baf75e6632 (patch) | |
| tree | c40b5597a05bd2b1a333be2693c4d4b7360a7d07 | |
| parent | 268a3de0a7737155eb5ab1372a9ed76599751847 (diff) | |
| download | rneovim-01236c3bfeba90a254de75ec720543baf75e6632.tar.gz rneovim-01236c3bfeba90a254de75ec720543baf75e6632.tar.bz2 rneovim-01236c3bfeba90a254de75ec720543baf75e6632.zip | |
vim-patch:9.1.1143: illegal memory access when putting a register (#32604)
Problem: illegal memory access when putting a register
Solution: make sure cursor column doesn't become negative
https://github.com/vim/vim/commit/e0029daa3599529d9d438cc51c7ada8580297a39
Co-authored-by: Christian Brabandt <cb@256bit.org>
| -rw-r--r-- | src/nvim/ops.c | 2 | ||||
| -rw-r--r-- | test/functional/legacy/register_spec.lua | 25 | ||||
| -rw-r--r-- | test/old/testdir/test_registers.vim | 17 |
3 files changed, 43 insertions, 1 deletions
diff --git a/src/nvim/ops.c b/src/nvim/ops.c index 3e2fa13cdd..72c75534d4 100644 --- a/src/nvim/ops.c +++ b/src/nvim/ops.c @@ -3623,7 +3623,7 @@ error: // Put the '] mark on the first byte of the last inserted character. // Correct the length for change in indent. curbuf->b_op_end.lnum = new_lnum; - col = (colnr_T)y_array[y_size - 1].size - lendiff; + col = MAX(0, (colnr_T)y_array[y_size - 1].size - lendiff); if (col > 1) { curbuf->b_op_end.col = col - 1; if (y_array[y_size - 1].size > 0) { diff --git a/test/functional/legacy/register_spec.lua b/test/functional/legacy/register_spec.lua new file mode 100644 index 0000000000..df470f3009 --- /dev/null +++ b/test/functional/legacy/register_spec.lua @@ -0,0 +1,25 @@ +local t = require('test.testutil') +local n = require('test.functional.testnvim')() + +local clear = n.clear +local exec = n.exec +local assert_alive = n.assert_alive +local fn = n.fn +local eq = t.eq + +describe('registers', function() + before_each(clear) + + -- oldtest: Test_register_cursor_column_negative() + it('no negative column when pasting', function() + exec([[ + f XREGISTER + call setline(1, 'abcdef a') + call setreg("a", "\n", 'c') + call cursor(1, 7) + call feedkeys("i\<C-R>\<C-P>azyx$#\<esc>", 't') + ]]) + assert_alive() + eq('XREGISTER', fn.bufname()) + end) +end) diff --git a/test/old/testdir/test_registers.vim b/test/old/testdir/test_registers.vim index fbacdaa2a0..0befdbd1fe 100644 --- a/test/old/testdir/test_registers.vim +++ b/test/old/testdir/test_registers.vim @@ -1006,4 +1006,21 @@ func Test_insert_small_delete_replace_mode() bwipe! endfunc +" this caused an illegal memory access and a crash +func Test_register_cursor_column_negative() + CheckRunVimInTerminal + let script =<< trim END + f XREGISTER + call setline(1, 'abcdef a') + call setreg("a", "\n", 'c') + call cursor(1, 7) + call feedkeys("i\<C-R>\<C-P>azyx$#\<esc>", 't') + END + call writefile(script, 'XRegister123', 'D') + let buf = RunVimInTerminal('-S XRegister123', {}) + call term_sendkeys(buf, "\<c-g>") + call WaitForAssert({-> assert_match('XREGISTER', term_getline(buf, 19))}) + call StopVimInTerminal(buf) +endfunc + " vim: shiftwidth=2 sts=2 expandtab |