vim-patch:8.2.2422: crash when deleting with line number out of range

Problem:    Crash when deleting with line number out of range. (Houyunsong)
Solution:   Avoid using a negative line number.
https://github.com/vim/vim/commit/1d859e24218635c57c09801840ff159cb845ae6a

1 files changed, 9 insertions, 2 deletions

diff --git a/src/nvim/normal.c b/src/nvim/normal.c
index 69afe1644e..a674560f08 100644
--- a/src/nvim/normal.c
+++ b/src/nvim/normal.c
@@ -818,7 +818,7 @@ static bool normal_get_command_count(NormalState *s)
     }
 
     if (s->ca.count0 < 0) {
-      // got too large!
+      // overflow
       s->ca.count0 = 999999999L;
     }
 
@@ -1025,10 +1025,14 @@ static int normal_execute(VimState *state, int key)
     // If you give a count before AND after the operator, they are
     // multiplied.
     if (s->ca.count0) {
-      s->ca.count0 *= s->ca.opcount;
+      s->ca.count0 = (long)((uint64_t)s->ca.count0 * (uint64_t)s->ca.opcount);
     } else {
       s->ca.count0 = s->ca.opcount;
     }
+    if (s->ca.count0 < 0) {
+      // overflow
+      s->ca.count0 = 999999999L;
+    }
   }
 
   // Always remember the count.  It will be set to zero (on the next call,
@@ -5817,6 +5821,9 @@ static void nv_percent(cmdarg_T *cap)
         curwin->w_cursor.lnum = (curbuf->b_ml.ml_line_count *
                                  cap->count0 + 99L) / 100L;
       }
+      if (curwin->w_cursor.lnum < 1) {
+        curwin->w_cursor.lnum = 1;
+      }
       if (curwin->w_cursor.lnum > curbuf->b_ml.ml_line_count) {
         curwin->w_cursor.lnum = curbuf->b_ml.ml_line_count;
       }