commit 93318a9933893103442f552b26bd0a41b98cb68b
author zeertzjq <zeertzjq@outlook.com> Mon Jun 16 20:10:38 2025 +0200
committer Christian Brabandt <cb@256bit.org> Mon Jun 16 20:10:38 2025 +0200
tree 344a69283278c08f2ceaf6b9ef411c244b8fb28a
parent 8ae8b304eea0301282b87f5bea1e4320080727f1

patch 9.1.1463: Integer overflow in getmarklist() after linewise operation

Problem:  Integer overflow in getmarklist() after linewise operation.
Solution: Don't add 1 to MAXCOL (zeertzjq)

related: neovim/neovim#34524
closes: #17552

Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>

src/mark.c

diff --git a/src/mark.c b/src/mark.c
index 9f6a9cc..2b03919 100644
--- a/src/mark.c
+++ b/src/mark.c
@@ -1464,7 +1464,7 @@
 
     list_append_number(lpos, bufnr);
     list_append_number(lpos, pos->lnum);
-    list_append_number(lpos, pos->col + 1);
+    list_append_number(lpos, pos->col < MAXCOL ? pos->col + 1 : MAXCOL);
     list_append_number(lpos, pos->coladd);
 
     if (dict_add_string(d, "mark", mname) == FAIL