From cf59d617bc6d2aabb487c4d6be8082160a633a39 Mon Sep 17 00:00:00 2001
From: KunMing Xie <qqzz014@gmail.com>
Date: Mon, 18 Sep 2017 02:04:17 +0800
Subject: vim-patch:8.0.0324 (#7279)

Problem:    Illegal memory access with "1;y".
Solution:   Call check_cursor() instead of check_cursor_lnum(). (Dominique
            Pelle, closes vim/vim#1455)

https://github.com/vim/vim/commit/f1f6f3f7df2938b3583e341482d96c1d53124c51
---
 src/nvim/ex_docmd.c               |  4 ++--
 src/nvim/testdir/test_cmdline.vim | 14 +++++++++++++-
 src/nvim/version.c                |  2 +-
 3 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/src/nvim/ex_docmd.c b/src/nvim/ex_docmd.c
index d1405978b3..bef5fd287e 100644
--- a/src/nvim/ex_docmd.c
+++ b/src/nvim/ex_docmd.c
@@ -1668,8 +1668,8 @@ static char_u * do_one_cmd(char_u **cmdlinep,
     if (*ea.cmd == ';') {
       if (!ea.skip) {
         curwin->w_cursor.lnum = ea.line2;
-        // Don't leave the cursor on an illegal line (caused by ';')
-        check_cursor_lnum();
+        // don't leave the cursor on an illegal line or column
+        check_cursor();
       }
     } else if (*ea.cmd != ',') {
       break;
diff --git a/src/nvim/testdir/test_cmdline.vim b/src/nvim/testdir/test_cmdline.vim
index 2facffb067..c0f04f4730 100644
--- a/src/nvim/testdir/test_cmdline.vim
+++ b/src/nvim/testdir/test_cmdline.vim
@@ -250,9 +250,21 @@ func Test_remove_char_in_cmdline()
     call assert_equal('"def', @:)
 endfunc
 
-func Test_illegal_address()
+func Test_illegal_address1()
   new
   2;'(
   2;')
   quit
 endfunc
+
+func Test_illegal_address2()
+  call writefile(['c', 'x', '  x', '.', '1;y'], 'Xtest.vim')
+  new
+  source Xtest.vim
+  " Trigger calling validate_cursor()
+  diffsp Xtest.vim
+  quit!
+  bwipe!
+  call delete('Xtest.vim')
+endfunc
+
diff --git a/src/nvim/version.c b/src/nvim/version.c
index e4142dea98..1f040b214b 100644
--- a/src/nvim/version.c
+++ b/src/nvim/version.c
@@ -628,7 +628,7 @@ static const int included_patches[] = {
   // 327,
   326,
   325,
-  // 324,
+  324,
   // 323,
   322,
   // 321,
-- 
cgit