To: vim_dev@googlegroups.com Subject: Patch 9.0.0192 Fcc: outbox From: Bram Moolenaar Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ------------ Patch 9.0.0192 Problem: Possible invalid memory access when 'cmdheight' is zero. (Martin Tournoij) Solution: Avoid going over the end of w_lines[] when w_height is Rows. (closes #10882) Files: src/drawscreen.c *** ../vim-9.0.0191/src/drawscreen.c 2022-07-30 16:54:01.863698294 +0100 --- src/drawscreen.c 2022-08-11 15:45:35.102459178 +0100 *************** *** 1808,1816 **** // Move the entries that were scrolled, disable // the entries for the lines to be redrawn. if ((wp->w_lines_valid += j) > wp->w_height) wp->w_lines_valid = wp->w_height; ! for (idx = wp->w_lines_valid; idx - j >= 0; idx--) wp->w_lines[idx] = wp->w_lines[idx - j]; while (idx >= 0) wp->w_lines[idx--].wl_valid = FALSE; --- 1808,1820 ---- // Move the entries that were scrolled, disable // the entries for the lines to be redrawn. + // Avoid using a wrong index when 'cmdheight' is + // zero and wp->w_height == Rows. if ((wp->w_lines_valid += j) > wp->w_height) wp->w_lines_valid = wp->w_height; ! for (idx = wp->w_lines_valid >= wp->w_height ! ? wp->w_height - 1 : wp->w_lines_valid; ! idx - j >= 0; idx--) wp->w_lines[idx] = wp->w_lines[idx - j]; while (idx >= 0) wp->w_lines[idx--].wl_valid = FALSE; *** ../vim-9.0.0191/src/version.c 2022-08-11 14:13:14.866778338 +0100 --- src/version.c 2022-08-11 15:48:11.757799769 +0100 *************** *** 737,738 **** --- 737,740 ---- { /* Add new patch number below this line */ + /**/ + 192, /**/ -- When danger reared its ugly head, He bravely turned his tail and fled Yes, Brave Sir Robin turned about And gallantly he chickened out Bravely taking to his feet He beat a very brave retreat Bravest of the brave Sir Robin Petrified of being dead Soiled his pants then brave Sir Robin Turned away and fled. "Monty Python and the Holy Grail" PYTHON (MONTY) PICTURES LTD /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net \\\ /// \\\ \\\ sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ /// \\\ help me help AIDS victims -- http://ICCF-Holland.org ///