To: vim_dev@googlegroups.com
Subject: Patch 8.2.4969
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 8.2.4969
Problem:    Changing text in Visual mode may cause invalid memory access.
Solution:   Check the Visual position after making a change.
Files:      src/change.c, src/edit.c, src/misc2.c, src/proto/misc2.pro,
            src/testdir/test_visual.vim


*** ../vim-8.2.4968/src/change.c	2022-05-14 18:47:58.807259718 +0100
--- src/change.c	2022-05-16 19:36:44.845917562 +0100
***************
*** 548,553 ****
--- 548,556 ----
  	curwin->w_changelistidx = curbuf->b_changelistlen;
      }
  
+     if (VIsual_active)
+ 	check_visual_pos();
+ 
      FOR_ALL_TAB_WINDOWS(tp, wp)
      {
  	if (wp->w_buffer == curbuf)
*** ../vim-8.2.4968/src/edit.c	2022-05-14 11:52:19.205341190 +0100
--- src/edit.c	2022-05-16 19:28:11.494567857 +0100
***************
*** 2541,2556 ****
  
  	    // <C-S-Right> may have started Visual mode, adjust the position for
  	    // deleted characters.
! 	    if (VIsual_active && VIsual.lnum == curwin->w_cursor.lnum)
! 	    {
! 		int len = (int)STRLEN(ml_get_curline());
! 
! 		if (VIsual.col > len)
! 		{
! 		    VIsual.col = len;
! 		    VIsual.coladd = 0;
! 		}
! 	    }
  	}
      }
      did_ai = FALSE;
--- 2541,2548 ----
  
  	    // <C-S-Right> may have started Visual mode, adjust the position for
  	    // deleted characters.
! 	    if (VIsual_active)
! 		check_visual_pos();
  	}
      }
      did_ai = FALSE;
*** ../vim-8.2.4968/src/misc2.c	2022-05-09 20:09:19.290641428 +0100
--- src/misc2.c	2022-05-16 19:32:27.165945578 +0100
***************
*** 622,627 ****
--- 622,652 ----
      check_cursor_col();
  }
  
+ /*
+  * Check if VIsual position is valid, correct it if not.
+  * Can be called when in Visual mode and a change has been made.
+  */
+     void
+ check_visual_pos(void)
+ {
+     if (VIsual.lnum > curbuf->b_ml.ml_line_count)
+     {
+ 	VIsual.lnum = curbuf->b_ml.ml_line_count;
+ 	VIsual.col = 0;
+ 	VIsual.coladd = 0;
+     }
+     else
+     {
+ 	int len = (int)STRLEN(ml_get(VIsual.lnum));
+ 
+ 	if (VIsual.col > len)
+ 	{
+ 	    VIsual.col = len;
+ 	    VIsual.coladd = 0;
+ 	}
+     }
+ }
+ 
  #if defined(FEAT_TEXTOBJ) || defined(PROTO)
  /*
   * Make sure curwin->w_cursor is not on the NUL at the end of the line.
***************
*** 2416,2422 ****
      return OK;
  }
  
! #if defined(EXITFREE) || defined(PROTOS)
  /*
   * Free the memory allocated by get_user_name()
   */
--- 2441,2447 ----
      return OK;
  }
  
! #if defined(EXITFREE) || defined(PROTO)
  /*
   * Free the memory allocated by get_user_name()
   */
*** ../vim-8.2.4968/src/proto/misc2.pro	2022-05-02 22:53:41.380211031 +0100
--- src/proto/misc2.pro	2022-05-16 19:32:30.037938663 +0100
***************
*** 17,22 ****
--- 17,23 ----
  void check_cursor_col(void);
  void check_cursor_col_win(win_T *win);
  void check_cursor(void);
+ void check_visual_pos(void);
  void adjust_cursor_col(void);
  int leftcol_changed(void);
  int copy_option_part(char_u **option, char_u *buf, int maxlen, char *sep_chars);
*** ../vim-8.2.4968/src/testdir/test_visual.vim	2022-05-06 11:44:03.815966278 +0100
--- src/testdir/test_visual.vim	2022-05-16 19:34:04.793877590 +0100
***************
*** 1296,1301 ****
--- 1296,1311 ----
    set isprint&
  endfunc
  
+ func Test_visual_block_with_substitute()
+   " this was reading beyond the end of the line
+   new
+   norm a0)
+   sil! norm  O
+   s/)
+   sil! norm 
+   bwipe!
+ endfunc
+ 
  func Test_visual_reselect_with_count()
    " this was causing an illegal memory access
    let lines =<< trim END
*** ../vim-8.2.4968/src/version.c	2022-05-16 18:06:12.035283526 +0100
--- src/version.c	2022-05-16 19:31:18.070112288 +0100
***************
*** 748,749 ****
--- 748,751 ----
  {   /* Add new patch number below this line */
+ /**/
+     4969,
  /**/

-- 
'Psychologist' -- Someone who looks at everyone else when
an attractive woman enters the room.

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///                                                                      \\\
\\\        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///