patch 8.0.1346: crash when passing 50 char string to balloon_split()
Problem: Crash when passing 50 char string to balloon_split().
Solution: Fix off-by-one error.
diff --git a/src/popupmnu.c b/src/popupmnu.c
index 77460a1..447f789 100644
--- a/src/popupmnu.c
+++ b/src/popupmnu.c
@@ -836,7 +836,7 @@
item->bytelen = p - item->start;
if (item->cells > max_cells)
max_cells = item->cells;
- long_item_count += item->cells / BALLOON_MIN_WIDTH;
+ long_item_count += (item->cells - 1) / BALLOON_MIN_WIDTH;
}
height = 2 + ga.ga_len;