terminal.c: Reset cursor postion when using termopen() (#6212)

After using 'termopen("echo") the current buffer content is changed,
but the cursor position of the current window is not updated.
Because of this, a call to 'mb_adjust_cursor()'  can lead to a
heap-buffer-overflow.

Fix this by resetting the cursor for the current window.

Fixes #3161

1 files changed, 23 insertions, 0 deletions

diff --git a/test/functional/terminal/buffer_spec.lua b/test/functional/terminal/buffer_spec.lua
index a75ec129e4..b61eef948d 100644
--- a/test/functional/terminal/buffer_spec.lua
+++ b/test/functional/terminal/buffer_spec.lua
@@ -4,6 +4,7 @@ local feed, clear, nvim = helpers.feed, helpers.clear, helpers.nvim
 local wait = helpers.wait
 local eval, execute, source = helpers.eval, helpers.execute, helpers.source
 local eq, neq = helpers.eq, helpers.neq
+local write_file = helpers.write_file
 
 if helpers.pending_win32(pending) then return end
 
@@ -207,3 +208,25 @@ describe('terminal buffer', function()
   end)
 end)
 
+describe('No heap-buffer-overflow when using', function()
+
+  local testfilename = 'Xtestfile-functional-terminal-buffers_spec'
+
+  before_each(function()
+    write_file(testfilename, "aaaaaaaaaaaaaaaaaaaaaaaaaaaa")
+  end)
+
+  after_each(function()
+    os.remove(testfilename)
+  end)
+
+  it('termopen(echo) #3161', function()
+    execute('edit ' .. testfilename)
+    -- Move cursor away from the beginning of the line
+    feed('$')
+    -- Let termopen() modify the buffer
+    execute('call termopen("echo")')
+    wait()
+    execute('bdelete!')
+  end)
+end)