From 2681e1fce3c4d8e88f3c573378985d84c4f032cf Mon Sep 17 00:00:00 2001 From: zeertzjq Date: Sat, 29 Mar 2025 10:07:14 +0800 Subject: fix(pum): fix heap-buffer-overflow with 'rightleft' (#33146) --- src/nvim/popupmenu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'src') diff --git a/src/nvim/popupmenu.c b/src/nvim/popupmenu.c index b1c6e02449..d26651fb84 100644 --- a/src/nvim/popupmenu.c +++ b/src/nvim/popupmenu.c @@ -686,13 +686,13 @@ void pum_redraw(void) char *rt_start = rt; int cells = vim_strsize(rt); - if (cells > pum_width) { + if (grid_col - cells < col_off - pum_width) { do { cells -= utf_ptr2cells(rt); MB_PTR_ADV(rt); - } while (cells > pum_width); + } while (grid_col - cells < col_off - pum_width); - if (cells < pum_width) { + if (grid_col - cells > col_off - pum_width) { // Most left character requires 2-cells but only 1 cell is available on // screen. Put a '<' on the left of the pum item. *(--rt) = '<'; -- cgit