vim-patch:9.1.0164: Internal error when passing invalid position to getregion() (#27805)

Problem:  Internal error or crash when passing invalid position to
          getregion().
Solution: Give an error for invalid position (zeertzjq).

closes: vim/vim#14172

https://github.com/vim/vim/commit/26dd09ad5e86f4e2179be0181421bfab9a6b3b75

3 files changed, 60 insertions, 19 deletions

diff --git a/src/nvim/eval/funcs.c b/src/nvim/eval/funcs.c
index 2f9472f158..f37542890b 100644
--- a/src/nvim/eval/funcs.c
+++ b/src/nvim/eval/funcs.c
@@ -2859,20 +2859,40 @@ static void f_getregion(typval_T *argvars, typval_T *rettv, EvalFuncData fptr)
   } else if (type[0] == Ctrl_V && type[1] == NUL) {
     region_type = kMTBlockWise;
   } else {
+    semsg(_(e_invargNval), "type", type);
     return;
   }
 
   buf_T *const save_curbuf = curbuf;
+  buf_T *findbuf = curbuf;
 
   if (fnum1 != 0) {
-    buf_T *findbuf = buflist_findnr(fnum1);
+    findbuf = buflist_findnr(fnum1);
     // buffer not loaded
     if (findbuf == NULL || findbuf->b_ml.ml_mfp == NULL) {
+      emsg(_(e_buffer_is_not_loaded));
       return;
     }
-    curbuf = findbuf;
   }
 
+  if (p1.lnum < 1 || p1.lnum > findbuf->b_ml.ml_line_count) {
+    semsg(_(e_invalid_line_number_nr), p1.lnum);
+    return;
+  }
+  if (p1.col < 1 || p1.col > ml_get_buf_len(findbuf, p1.lnum) + 1) {
+    semsg(_(e_invalid_column_number_nr), p1.col);
+    return;
+  }
+  if (p2.lnum < 1 || p2.lnum > findbuf->b_ml.ml_line_count) {
+    semsg(_(e_invalid_line_number_nr), p2.lnum);
+    return;
+  }
+  if (p2.col < 1 || p2.col > ml_get_buf_len(findbuf, p2.lnum) + 1) {
+    semsg(_(e_invalid_column_number_nr), p2.col);
+    return;
+  }
+
+  curbuf = findbuf;
   const TriState save_virtual = virtual_op;
   virtual_op = virtual_active();
 
@@ -2900,7 +2920,7 @@ static void f_getregion(typval_T *argvars, typval_T *rettv, EvalFuncData fptr)
         mark_mb_adjustpos(curbuf, &p2);
       } else if (p2.lnum > 1) {
         p2.lnum--;
-        p2.col = (colnr_T)strlen(ml_get(p2.lnum));
+        p2.col = ml_get_len(p2.lnum);
         if (p2.col > 0) {
           p2.col--;
           mark_mb_adjustpos(curbuf, &p2);
diff --git a/src/nvim/globals.h b/src/nvim/globals.h
index c1c9ae456c..113985cb52 100644
--- a/src/nvim/globals.h
+++ b/src/nvim/globals.h
@@ -958,6 +958,7 @@ EXTERN const char e_highlight_group_name_invalid_char[] INIT(= N_("E5248: Invali
 
 EXTERN const char e_highlight_group_name_too_long[] INIT(= N_("E1249: Highlight group name too long"));
 
+EXTERN const char e_invalid_column_number_nr[] INIT( = N_("E964: Invalid column number: %ld"));
 EXTERN const char e_invalid_line_number_nr[] INIT(= N_("E966: Invalid line number: %ld"));
 
 EXTERN const char e_stray_closing_curly_str[]
diff --git a/test/old/testdir/test_visual.vim b/test/old/testdir/test_visual.vim
index 4c5ab9f61f..74742abc5d 100644
--- a/test/old/testdir/test_visual.vim
+++ b/test/old/testdir/test_visual.vim
@@ -1741,40 +1741,60 @@ func Test_visual_getregion()
           \ getregion(getpos('v'), getpos('.'), {'type': "\<C-v>" }))
     set virtualedit&
 
-    #" Invalid position
+    #" using wrong types for positions
     call cursor(1, 1)
     call feedkeys("\<ESC>vjj$", 'tx')
     call assert_fails("call getregion(1, 2)", 'E1211:')
     call assert_fails("call getregion(getpos('.'), {})", 'E1211:')
-    call assert_equal([], getregion(getpos('.'), getpos('.'), {'type': '' }))
-
-    #" using the wrong type
     call assert_fails(':echo "."->getpos()->getregion("$", [])', 'E1211:')
 
+    #" using invalid value for "type"
+    call assert_fails("call getregion(getpos('.'), getpos('.'), {'type': '' })", 'E475:')
+
     #" using a mark from another buffer to current buffer
     new
-    VAR newbuf = bufnr()
+    LET g:buf = bufnr()
     call setline(1, range(10))
     normal! GmA
     wincmd p
-    call assert_equal([newbuf, 10, 1, 0], getpos("'A"))
+    call assert_equal([g:buf, 10, 1, 0], getpos("'A"))
     call assert_equal([], getregion(getpos('.'), getpos("'A"), {'type': 'v' }))
     call assert_equal([], getregion(getpos("'A"), getpos('.'), {'type': 'v' }))
-    exe $':{newbuf}bwipe!'
 
-    #" using a mark from another buffer to another buffer
-    new
-    VAR anotherbuf = bufnr()
-    call setline(1, range(10))
-    normal! GmA
+    #" using two marks from another buffer
+    wincmd p
     normal! GmB
     wincmd p
-    call assert_equal([anotherbuf, 10, 1, 0], getpos("'A"))
+    call assert_equal([g:buf, 10, 1, 0], getpos("'B"))
     call assert_equal(['9'], getregion(getpos("'B"), getpos("'A"), {'type': 'v' }))
-    exe $':{anotherbuf}bwipe!'
+
+    #" using two positions from another buffer
+    for type in ['v', 'V', "\<C-V>"]
+      for exclusive in [v:false, v:true]
+        call assert_equal(range(10)->mapnew('string(v:val)'),
+              \ getregion([g:buf, 1, 1, 0], [g:buf, 10, 2, 0]),
+              \ {'type': type, 'exclusive': exclusive })
+        call assert_equal(range(10)->mapnew('string(v:val)'),
+              \ getregion([g:buf, 10, 2, 0], [g:buf, 1, 1, 0]),
+              \ {'type': type, 'exclusive': exclusive })
+      endfor
+    endfor
+
+    #" using invalid positions in buffer
+    call assert_fails('call getregion([g:buf, 0, 1, 0], [g:buf, 10, 2, 0])', 'E966:')
+    call assert_fails('call getregion([g:buf, 10, 2, 0], [g:buf, 0, 1, 0])', 'E966:')
+    call assert_fails('call getregion([g:buf, 1, 1, 0], [g:buf, 11, 2, 0])', 'E966:')
+    call assert_fails('call getregion([g:buf, 11, 2, 0], [g:buf, 1, 1, 0])', 'E966:')
+    call assert_fails('call getregion([g:buf, 1, 1, 0], [g:buf, 10, 0, 0])', 'E964:')
+    call assert_fails('call getregion([g:buf, 10, 0, 0], [g:buf, 1, 1, 0])', 'E964:')
+    call assert_fails('call getregion([g:buf, 1, 1, 0], [g:buf, 10, 3, 0])', 'E964:')
+    call assert_fails('call getregion([g:buf, 10, 3, 0], [g:buf, 1, 1, 0])', 'E964:')
 
     #" using invalid buffer
-    call assert_equal([], getregion([10000, 10, 1, 0], [10000, 10, 1, 0]))
+    call assert_fails('call getregion([10000, 10, 1, 0], [10000, 10, 1, 0])', 'E681:')
+
+    exe $':{g:buf}bwipe!'
+    unlet g:buf
   END
   call CheckLegacyAndVim9Success(lines)
 
@@ -1935,7 +1955,7 @@ func Test_getregion_invalid_buf()
   call assert_equal(['Move around:'], getregion(getpos("'A"), getpos("'B")))
   " close the help window
   q
-  call assert_equal([], getregion(getpos("'A"), getpos("'B")))
+  call assert_fails("call getregion(getpos(\"'A\"), getpos(\"'B\"))", 'E681:')
   bwipe!
 endfunc