diff --git a/src/ops.c b/src/ops.c index 0f42dea003..5c58e523f3 100644 --- a/src/ops.c +++ b/src/ops.c @@ -396,7 +396,10 @@ shift_block(oparg_T *oap, int amount) return; /* total is number of screen columns to be inserted/removed */ - total = amount * p_sw; + total = (int)((unsigned)amount * (unsigned)p_sw); + if ((total / p_sw) != amount) + return; /* multiplication overflow */ + oldp = ml_get_curline(); if (!left) diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim index 371fab57a1..97b884fe0c 100644 --- a/src/testdir/test_visual.vim +++ b/src/testdir/test_visual.vim @@ -18,6 +18,14 @@ func Test_block_shift_multibyte() q! endfunc +func Test_block_shift_overflow() + " This used to cause a multiplication overflow followed by a crash. + new + normal ii + exe "normal \876543210>" + q! +endfunc + func Test_dotregister_paste() new exe "norm! ihello world\" diff --git a/src/version.c b/src/version.c index de89ce45af..784f6c1e27 100644 --- a/src/version.c +++ b/src/version.c @@ -769,6 +769,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 879, /**/ 878, /**/