commit a3571ebef5a2969d16e3e202ec4bca8858aca6ba
author Bram Moolenaar <Bram@vim.org> Sun Nov 26 16:53:16 2017 +0100
committer Bram Moolenaar <Bram@vim.org> Sun Nov 26 16:53:16 2017 +0100
tree e3fa434b1f473c4fd5d1167ee0ff4a343eae1c2e
parent c41838aa01ef99540e2737c42e9b1283e3da5e26

patch 8.0.1346: crash when passing 50 char string to balloon_split()

Problem:    Crash when passing 50 char string to balloon_split().
Solution:   Fix off-by-one error.

src/popupmnu.c

diff --git a/src/popupmnu.c b/src/popupmnu.c
index 77460a1..447f789 100644
--- a/src/popupmnu.c
+++ b/src/popupmnu.c
@@ -836,7 +836,7 @@
 	item->bytelen = p - item->start;
 	if (item->cells > max_cells)
 	    max_cells = item->cells;
-	long_item_count += item->cells / BALLOON_MIN_WIDTH;
+	long_item_count += (item->cells - 1) / BALLOON_MIN_WIDTH;
     }
 
     height = 2 + ga.ga_len;

src/testdir/test_popup.vim

diff --git a/src/testdir/test_popup.vim b/src/testdir/test_popup.vim
index 2bb9b32..6250c1b 100644
--- a/src/testdir/test_popup.vim
+++ b/src/testdir/test_popup.vim
@@ -708,6 +708,10 @@
     return
   endif
   call assert_equal([
+        \ 'tempname: 0x555555e380a0 "/home/mool/.viminfz.tmp"',
+        \ ], balloon_split(
+        \ 'tempname: 0x555555e380a0 "/home/mool/.viminfz.tmp"'))
+  call assert_equal([
         \ 'one two three four one two three four one two thre',
         \ 'e four',
         \ ], balloon_split(

src/version.c

diff --git a/src/version.c b/src/version.c
index 5b3b797..55754fa 100644
--- a/src/version.c
+++ b/src/version.c
@@ -772,6 +772,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1346,
+/**/
     1345,
 /**/
     1344,