IntenseFinance/neovim
3
0 Fork 0
mirror of https://github.com/neovim/neovim.git synced 2026-10-25 23:20:23 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix(statuscolumn): heap buffer overflow with sign/number column (#41640)

Browse Source 
Problem:  Drawing 'statuscolumn' leads to a heap-buffer-overflow if a
          sign/number column comes after many items.
Solution: Avoid curitem >= stl_items_len when writing to stl_items.
This commit is contained in:
zeertzjq authored and GitHub committed 2026-09-03 16:56:41 +08:00
1 parent 9222ed3a4a
commit 51eacf284c
2 files changed
+61 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

test/functional/ui/statuscolumn_spec.lua
+43
View File
@@ -1243,4 +1243,47 @@ describe('statuscolumn', function()
|
]])
end)
describe('no heap-buffer-overflow with', function()
it('%s after many items #41630', function()
exec([[
set nonumber signcolumn=yes
let &statuscolumn = repeat('%=', 99) .. '%s'
]])
screen:expect([[
{7: }aaaaa |*4
{7: }^aaaaa |
{7: }aaaaa |*8
|
]])
assert_alive()
end)
it('%l after many items', function()
exec([[
func Statuscolumn()
return repeat('%=', v:relnum == 0 ? 149 : 99) .. '%l '
endfunc
set number numberwidth=4 relativenumber
set statuscolumn=%!Statuscolumn()
]])
screen:expect([[
{8: 4 }aaaaa |
{8: 3 }aaaaa |
{8: 2 }aaaaa |
{8: 1 }aaaaa |
{8:8 }^aaaaa |
{8: 1 }aaaaa |
{8: 2 }aaaaa |
{8: 3 }aaaaa |
{8: 4 }aaaaa |
{8: 5 }aaaaa |
{8: 6 }aaaaa |
{8: 7 }aaaaa |
{8: 8 }aaaaa |
|
]])
assert_alive()
end)
end)
end)