1
0
forked from aniani/vim

patch 8.2.2243: crash when popup mask contains zeroes

Problem:    Crash when popup mask contains zeroes.
Solution:   Check boundaries properly. (closes #7569)
This commit is contained in:
Bram Moolenaar
2020-12-29 11:57:46 +01:00
parent 8242ebbdba
commit 4012d26207
3 changed files with 16 additions and 2 deletions

View File

@@ -3346,21 +3346,29 @@ popup_update_mask(win_T *wp, int width, int height)
cols = tv_get_number(&li->li_tv); cols = tv_get_number(&li->li_tv);
if (cols < 0) if (cols < 0)
cols = width + cols + 1; cols = width + cols + 1;
if (cols <= 0)
cols = 1;
li = li->li_next; li = li->li_next;
cole = tv_get_number(&li->li_tv); cole = tv_get_number(&li->li_tv);
if (cole < 0) if (cole < 0)
cole = width + cole + 1; cole = width + cole + 1;
if (cole > width)
cole = width;
li = li->li_next; li = li->li_next;
lines = tv_get_number(&li->li_tv); lines = tv_get_number(&li->li_tv);
if (lines < 0) if (lines < 0)
lines = height + lines + 1; lines = height + lines + 1;
if (lines <= 0)
lines = 1;
li = li->li_next; li = li->li_next;
linee = tv_get_number(&li->li_tv); linee = tv_get_number(&li->li_tv);
if (linee < 0) if (linee < 0)
linee = height + linee + 1; linee = height + linee + 1;
if (linee > height)
linee = height;
for (row = lines - 1; row < linee && row < height; ++row) for (row = lines - 1; row < linee; ++row)
for (col = cols - 1; col < cole && col < width; ++col) for (col = cols - 1; col < cole; ++col)
cells[row * width + col] = 1; cells[row * width + col] = 1;
} }
} }

View File

@@ -821,6 +821,10 @@ func Test_popup_with_mask()
" clean up " clean up
call StopVimInTerminal(buf) call StopVimInTerminal(buf)
call delete('XtestPopupMask') call delete('XtestPopupMask')
" this was causing a crash
call popup_create('test', #{mask: [[0, 0, 0, 0]]})
call popup_clear()
endfunc endfunc
func Test_popup_select() func Test_popup_select()

View File

@@ -750,6 +750,8 @@ static char *(features[]) =
static int included_patches[] = static int included_patches[] =
{ /* Add new patch number below this line */ { /* Add new patch number below this line */
/**/
2243,
/**/ /**/
2242, 2242,
/**/ /**/