vim-patch:7.4.936 #4271

Problem:    Crash when dragging with the mouse.
Solution:   Add safety check for NULL pointer. Check mouse position for valid
            value. (Hirohito Higashi)

https://github.com/vim/vim/commit/294a7e55b01149154807a23323038784549b8946

---

see: "Crash while mouse-selecting in two-buffer mode"
     https://github.com/vim/vim/issues/486

Fix #3704

3 files changed, 21 insertions, 4 deletions

diff --git a/src/nvim/os/input.c b/src/nvim/os/input.c
index e632544856..f317fd6b5a 100644
--- a/src/nvim/os/input.c
+++ b/src/nvim/os/input.c
@@ -250,6 +250,14 @@ static unsigned int handle_mouse_event(char **ptr, uint8_t *buf,
   int col, row, advance;
   if (sscanf(*ptr, "<%d,%d>%n", &col, &row, &advance) != EOF && advance) {
     if (col >= 0 && row >= 0) {
+      // Make sure the mouse position is valid.  Some terminals may
+      // return weird values.
+      if (col >= Columns) {
+        col = (int)Columns - 1;
+      }
+      if (row >= Rows) {
+        row = (int)Rows - 1;
+      }
       mouse_row = row;
       mouse_col = col;
     }
diff --git a/src/nvim/version.c b/src/nvim/version.c
index 9c29dc350c..80b1b236dd 100644
--- a/src/nvim/version.c
+++ b/src/nvim/version.c
@@ -354,7 +354,7 @@ static int included_patches[] = {
   939,
   // 938 NA
   937,
-  // 936,
+  936,
   // 935 NA
   // 934 NA
   933,
diff --git a/src/nvim/window.c b/src/nvim/window.c
index 36cb48f3a1..39106a7b8d 100644
--- a/src/nvim/window.c
+++ b/src/nvim/window.c
@@ -4575,10 +4575,19 @@ void win_drag_vsep_line(win_T *dragwin, int offset)
   }
   assert(fr);
 
-  if (room < offset)            /* Not enough room */
-    offset = room;              /* Move as far as we can */
-  if (offset <= 0)              /* No room at all, quit. */
+  // Not enough room
+  if (room < offset) {
+    offset = room;  // Move as far as we can
+  }
+
+  // No room at all, quit.
+  if (offset <= 0) {
     return;
+  }
+
+  if (fr == NULL) {
+    return;  // Safety check, should not happen.
+  }
 
   /* grow frame fr by offset lines */
   frame_new_width(fr, fr->fr_width + offset, left, FALSE);