patch 8.0.0879: crash when shifting with huge number
Problem: Crash when shifting with huge number.
Solution: Check for overflow. (Dominique Pelle, closes #1945)
diff --git a/src/ops.c b/src/ops.c
index 0f42dea..5c58e52 100644
--- a/src/ops.c
+++ b/src/ops.c
@@ -396,7 +396,10 @@
return;
/* total is number of screen columns to be inserted/removed */
- total = amount * p_sw;
+ total = (int)((unsigned)amount * (unsigned)p_sw);
+ if ((total / p_sw) != amount)
+ return; /* multiplication overflow */
+
oldp = ml_get_curline();
if (!left)
diff --git a/src/testdir/test_visual.vim b/src/testdir/test_visual.vim
index 371fab5..97b884f 100644
--- a/src/testdir/test_visual.vim
+++ b/src/testdir/test_visual.vim
@@ -18,6 +18,14 @@
q!
endfunc
+func Test_block_shift_overflow()
+ " This used to cause a multiplication overflow followed by a crash.
+ new
+ normal ii
+ exe "normal \<C-V>876543210>"
+ q!
+endfunc
+
func Test_dotregister_paste()
new
exe "norm! ihello world\<esc>"
diff --git a/src/version.c b/src/version.c
index de89ce4..784f6c1 100644
--- a/src/version.c
+++ b/src/version.c
@@ -770,6 +770,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 879,
+/**/
878,
/**/
877,