commit 24922ec23360e7ea7c5a803c9edf476bb6395b32
author Bram Moolenaar <Bram@vim.org> Thu Feb 23 17:59:22 2017 +0100
committer Bram Moolenaar <Bram@vim.org> Thu Feb 23 17:59:22 2017 +0100
tree c23edca1b1a49453b68a57e4e4ae6c7e1d217b94
parent 354796c19a0a4a048017059a0281938cc0b8f09a

patch 8.0.0357: crash when setting 'guicursor' to weird value

Problem:    Crash when setting 'guicursor' to weird value.
Solution:   Avoid negative size. (Dominique Pelle, closes #1465)

src/misc2.c

diff --git a/src/misc2.c b/src/misc2.c
index 71ca6d8..992e5c2 100644
--- a/src/misc2.c
+++ b/src/misc2.c
@@ -3472,11 +3472,12 @@
 	while (*modep != NUL)
 	{
 	    colonp = vim_strchr(modep, ':');
-	    if (colonp == NULL)
+	    commap = vim_strchr(modep, ',');
+
+	    if (colonp == NULL || (commap != NULL && commap < colonp))
 		return (char_u *)N_("E545: Missing colon");
 	    if (colonp == modep)
 		return (char_u *)N_("E546: Illegal mode");
-	    commap = vim_strchr(modep, ',');
 
 	    /*
 	     * Repeat for all mode's before the colon.