From d811fab0ad3e679acc27a4ff8f399fcf04726aa9 Mon Sep 17 00:00:00 2001 From: Jan Edmund Lazo Date: Wed, 15 Jan 2020 22:20:21 -0500 Subject: vim-patch:8.2.0120: virtcol() does not check arguments to be valid Problem: virtcol() does not check arguments to be valid, which may lead to a crash. Solution: Check the column to be valid. Do not decrement MAXCOL. (closes vim/vim#5480) https://github.com/vim/vim/commit/b3d33d8570bc49a7f90990572d7f9630a1bfae02 --- src/nvim/eval.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) (limited to 'src/nvim/eval.c') diff --git a/src/nvim/eval.c b/src/nvim/eval.c index 9916ee3bd3..797c61a482 100644 --- a/src/nvim/eval.c +++ b/src/nvim/eval.c @@ -16018,7 +16018,7 @@ static void f_setpos(typval_T *argvars, typval_T *rettv, FunPtr fptr) const char *const name = tv_get_string_chk(argvars); if (name != NULL) { if (list2fpos(&argvars[1], &pos, &fnum, &curswant) == OK) { - if (--pos.col < 0) { + if (pos.col != MAXCOL && --pos.col < 0) { pos.col = 0; } if (name[0] == '.' && name[1] == NUL) { @@ -19045,6 +19045,15 @@ static void f_virtcol(typval_T *argvars, typval_T *rettv, FunPtr fptr) fp = var2fpos(&argvars[0], FALSE, &fnum); if (fp != NULL && fp->lnum <= curbuf->b_ml.ml_line_count && fnum == curbuf->b_fnum) { + // Limit the column to a valid value, getvvcol() doesn't check. + if (fp->col < 0) { + fp->col = 0; + } else { + const size_t len = STRLEN(ml_get(fp->lnum)); + if (fp->col > (colnr_T)len) { + fp->col = (colnr_T)len; + } + } getvvcol(curwin, fp, NULL, NULL, &vcol); ++vcol; } -- cgit