vim-patch:8.2.0120: virtcol() does not check arguments to be valid

Problem:    virtcol() does not check arguments to be valid, which may lead to
            a crash.
Solution:   Check the column to be valid.  Do not decrement MAXCOL.
            (closes vim/vim#5480)
https://github.com/vim/vim/commit/b3d33d8570bc49a7f90990572d7f9630a1bfae02

2 files changed, 29 insertions, 3 deletions

diff --git a/src/nvim/eval.c b/src/nvim/eval.c
index 9916ee3bd3..797c61a482 100644
--- a/src/nvim/eval.c
+++ b/src/nvim/eval.c
@@ -16018,7 +16018,7 @@ static void f_setpos(typval_T *argvars, typval_T *rettv, FunPtr fptr)
   const char *const name = tv_get_string_chk(argvars);
   if (name != NULL) {
     if (list2fpos(&argvars[1], &pos, &fnum, &curswant) == OK) {
-      if (--pos.col < 0) {
+      if (pos.col != MAXCOL && --pos.col < 0) {
         pos.col = 0;
       }
       if (name[0] == '.' && name[1] == NUL) {
@@ -19045,6 +19045,15 @@ static void f_virtcol(typval_T *argvars, typval_T *rettv, FunPtr fptr)
   fp = var2fpos(&argvars[0], FALSE, &fnum);
   if (fp != NULL && fp->lnum <= curbuf->b_ml.ml_line_count
       && fnum == curbuf->b_fnum) {
+    // Limit the column to a valid value, getvvcol() doesn't check.
+    if (fp->col < 0) {
+      fp->col = 0;
+    } else {
+      const size_t len = STRLEN(ml_get(fp->lnum));
+      if (fp->col > (colnr_T)len) {
+        fp->col = (colnr_T)len;
+      }
+    }
     getvvcol(curwin, fp, NULL, NULL, &vcol);
     ++vcol;
   }
diff --git a/src/nvim/testdir/test_marks.vim b/src/nvim/testdir/test_marks.vim
index 272553c29f..06b9dc9dab 100644
--- a/src/nvim/testdir/test_marks.vim
+++ b/src/nvim/testdir/test_marks.vim
@@ -26,11 +26,11 @@ function! Test_Incr_Marks()
 endfunction
 
 func Test_setpos()
-  new one
+  new Xone
   let onebuf = bufnr('%')
   let onewin = win_getid()
   call setline(1, ['aaa', 'bbb', 'ccc'])
-  new two
+  new Xtwo
   let twobuf = bufnr('%')
   let twowin = win_getid()
   call setline(1, ['aaa', 'bbb', 'ccc'])
@@ -63,7 +63,24 @@ func Test_setpos()
   call setpos("'N", [onebuf, 1, 3, 0])
   call assert_equal([onebuf, 1, 3, 0], getpos("'N"))
 
+  " try invalid column and check virtcol()
   call win_gotoid(onewin)
+  call setpos("'a", [0, 1, 2, 0])
+  call assert_equal([0, 1, 2, 0], getpos("'a"))
+  call setpos("'a", [0, 1, -5, 0])
+  call assert_equal([0, 1, 2, 0], getpos("'a"))
+  call setpos("'a", [0, 1, 0, 0])
+  call assert_equal([0, 1, 1, 0], getpos("'a"))
+  call setpos("'a", [0, 1, 4, 0])
+  call assert_equal([0, 1, 4, 0], getpos("'a"))
+  call assert_equal(4, virtcol("'a"))
+  call setpos("'a", [0, 1, 5, 0])
+  call assert_equal([0, 1, 5, 0], getpos("'a"))
+  call assert_equal(4, virtcol("'a"))
+  call setpos("'a", [0, 1, 21341234, 0])
+  call assert_equal([0, 1, 21341234, 0], getpos("'a"))
+  call assert_equal(4, virtcol("'a"))
+
   bwipe!
   call win_gotoid(twowin)
   bwipe!