IntenseFinance/neovim
3
0
Fork 0
mirror of https://github.com/neovim/neovim.git synced 2025-02-25 18:55:25 -06:00
Code Issues Packages Projects Releases Wiki Activity

vim-patch:8.0.0879: crash when shifting with huge number

Browse Source 
Problem:    Crash when shifting with huge number.
Solution:   Check for overflow. (Dominique Pelle, closes vim/vim#1945)
bae5a17a73
This commit is contained in:
Jan Edmund Lazo 2018-07-14 18:03:20 -04:00
parent 0e57c753d6
commit 7f2e352700
2 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/nvim/ops.c
View File

@ -312,7 +312,6 @@ static void shift_block(oparg_T *oap, int amount)
{
int left = (oap->op_type == OP_LSHIFT);
int oldstate = State;
int total;
char_u *newp, *oldp;
int oldcol = curwin->w_cursor.col;
int p_sw = get_sw_value(curbuf);
@ -331,8 +330,12 @@ static void shift_block(oparg_T *oap, int amount)
if (bd.is_short)
return;
/* total is number of screen columns to be inserted/removed */
total = amount * p_sw;
// total is number of screen columns to be inserted/removed
int total = (int)((unsigned)amount * (unsigned)p_sw);
if ((total / p_sw) != amount) {
return; // multiplication overflow
}
oldp = get_cursor_line_ptr();
if (!left) {

8
src/nvim/testdir/test_visual.vim
View File

@ -17,6 +17,14 @@ func Test_block_shift_multibyte()
q!
endfunc
func Test_block_shift_overflow()
" This used to cause a multiplication overflow followed by a crash.
new
normal ii
exe "normal \<C-V>876543210>"
q!
endfunc
func Test_Visual_ctrl_o()
new
call setline(1, ['one', 'two', 'three'])