patch 8.2.2243: crash when popup mask contains zeroes
Problem: Crash when popup mask contains zeroes.
Solution: Check boundaries properly. (closes #7569)
diff --git a/src/popupwin.c b/src/popupwin.c
index 13a455d..7896efd 100644
--- a/src/popupwin.c
+++ b/src/popupwin.c
@@ -3346,21 +3346,29 @@
cols = tv_get_number(&li->li_tv);
if (cols < 0)
cols = width + cols + 1;
+ if (cols <= 0)
+ cols = 1;
li = li->li_next;
cole = tv_get_number(&li->li_tv);
if (cole < 0)
cole = width + cole + 1;
+ if (cole > width)
+ cole = width;
li = li->li_next;
lines = tv_get_number(&li->li_tv);
if (lines < 0)
lines = height + lines + 1;
+ if (lines <= 0)
+ lines = 1;
li = li->li_next;
linee = tv_get_number(&li->li_tv);
if (linee < 0)
linee = height + linee + 1;
+ if (linee > height)
+ linee = height;
- for (row = lines - 1; row < linee && row < height; ++row)
- for (col = cols - 1; col < cole && col < width; ++col)
+ for (row = lines - 1; row < linee; ++row)
+ for (col = cols - 1; col < cole; ++col)
cells[row * width + col] = 1;
}
}
diff --git a/src/testdir/test_popupwin.vim b/src/testdir/test_popupwin.vim
index b8641fe..bfc0494 100644
--- a/src/testdir/test_popupwin.vim
+++ b/src/testdir/test_popupwin.vim
@@ -821,6 +821,10 @@
" clean up
call StopVimInTerminal(buf)
call delete('XtestPopupMask')
+
+ " this was causing a crash
+ call popup_create('test', #{mask: [[0, 0, 0, 0]]})
+ call popup_clear()
endfunc
func Test_popup_select()
diff --git a/src/version.c b/src/version.c
index ee0d987..6c6d8c6 100644
--- a/src/version.c
+++ b/src/version.c
@@ -751,6 +751,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 2243,
+/**/
2242,
/**/
2241,