vim-patch:7.4.2326

Problem:    Illegal memory access when Visual selection starts in invalid
            position. (Dominique Pelle)
Solution:   Correct position when needed.

https://github.com/vim/vim/commit/d5824ce1b5491df7d2eb0b66189d366fa67b4585

3 files changed, 20 insertions, 1 deletions

diff --git a/src/nvim/cursor.c b/src/nvim/cursor.c
index 3ba9da34f2..01476627de 100644
--- a/src/nvim/cursor.c
+++ b/src/nvim/cursor.c
@@ -294,6 +294,24 @@ linenr_T get_cursor_rel_lnum(win_T *wp, linenr_T lnum)
   return (lnum < cursor) ? -retval : retval;
 }
 
+// Make sure "pos.lnum" and "pos.col" are valid in "buf".
+// This allows for the col to be on the NUL byte.
+void check_pos(buf_T *buf, pos_T *pos) {
+  char_u *line;
+  colnr_T len;
+
+  if (pos->lnum > buf->b_ml.ml_line_count) {
+     pos->lnum = buf->b_ml.ml_line_count;
+  }
+
+  if (pos->col > 0) {
+     line = ml_get_buf(buf, pos->lnum, FALSE);
+     len = (colnr_T)STRLEN(line);
+     if (pos->col > len)
+         pos->col = len;
+  }
+}
+
 /*
  * Make sure curwin->w_cursor.lnum is valid.
  */
diff --git a/src/nvim/normal.c b/src/nvim/normal.c
index ee3c3f9f11..1fd03257ec 100644
--- a/src/nvim/normal.c
+++ b/src/nvim/normal.c
@@ -7831,6 +7831,7 @@ static void get_op_vcol(
 
   // prevent from moving onto a trail byte
   if (has_mbyte) {
+    check_pos(curwin->w_buffer, &oap->end);
     mb_adjustpos(curwin->w_buffer, &oap->end);
   }
 
diff --git a/src/nvim/version.c b/src/nvim/version.c
index 7f07e5a287..09fe1d029b 100644
--- a/src/nvim/version.c
+++ b/src/nvim/version.c
@@ -115,7 +115,7 @@ static int included_patches[] = {
   // 2329,
   // 2328,
   // 2327 NA
-  // 2326,
+  2326,
   // 2325 NA
   // 2324,
   // 2323,