patch 8.2.2422: crash when deleting with line number out of range
Problem: Crash when deleting with line number out of range. (Houyunsong)
Solution: Avoid using a negative line number.
diff --git a/src/normal.c b/src/normal.c
index c70971f..9fbfadf 100644
--- a/src/normal.c
+++ b/src/normal.c
@@ -630,7 +630,7 @@
}
else
ca.count0 = ca.count0 * 10 + (c - '0');
- if (ca.count0 < 0) // got too large!
+ if (ca.count0 < 0) // overflow
ca.count0 = 999999999L;
#ifdef FEAT_EVAL
// Set v:count here, when called from main() and not a stuffed
@@ -701,6 +701,8 @@
ca.count0 *= ca.opcount;
else
ca.count0 = ca.opcount;
+ if (ca.count0 < 0) // overflow
+ ca.count0 = 999999999L;
}
/*
@@ -4775,6 +4777,8 @@
else
curwin->w_cursor.lnum = (curbuf->b_ml.ml_line_count *
cap->count0 + 99L) / 100L;
+ if (curwin->w_cursor.lnum < 1)
+ curwin->w_cursor.lnum = 1;
if (curwin->w_cursor.lnum > curbuf->b_ml.ml_line_count)
curwin->w_cursor.lnum = curbuf->b_ml.ml_line_count;
beginline(BL_SOL | BL_FIX);
diff --git a/src/testdir/test_ex_mode.vim b/src/testdir/test_ex_mode.vim
index 3c6d08e..a07649e 100644
--- a/src/testdir/test_ex_mode.vim
+++ b/src/testdir/test_ex_mode.vim
@@ -206,4 +206,20 @@
call delete('Xexmodescript')
endfunc
+func Test_ex_mode_count_overflow()
+ " this used to cause a crash
+ let lines =<< trim END
+ call feedkeys("\<Esc>Q\<CR>")
+ v9|9silent! vi|333333233333y32333333%O
+ call writefile(['done'], 'Xdidexmode')
+ qall!
+ END
+ call writefile(lines, 'Xexmodescript')
+ call assert_equal(1, RunVim([], [], '-e -s -S Xexmodescript -c qa'))
+ call assert_equal(['done'], readfile('Xdidexmode'))
+
+ call delete('Xdidexmode')
+ call delete('Xexmodescript')
+endfunc
+
" vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 9709e32..c710be8 100644
--- a/src/version.c
+++ b/src/version.c
@@ -751,6 +751,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 2422,
+/**/
2421,
/**/
2420,