commit bae5a17a738d1a3b5c51d9aa5d99e228d3911955
author Bram Moolenaar <Bram@vim.org> Sun Aug 06 15:42:06 2017 +0200
committer Bram Moolenaar <Bram@vim.org> Sun Aug 06 15:42:06 2017 +0200
tree 8e5eade690175963af3c749a4c368acf3b346164
parent cae92dc3d5bdd4009910671328cd01394bfbe2cf

patch 8.0.0879: crash when shifting with huge number

Problem:    Crash when shifting with huge number.
Solution:   Check for overflow. (Dominique Pelle, closes #1945)

src/ops.c

diff --git a/src/ops.c b/src/ops.c
index 0f42dea..5c58e52 100644
--- a/src/ops.c
+++ b/src/ops.c
@@ -396,7 +396,10 @@
 	return;
 
     /* total is number of screen columns to be inserted/removed */
-    total = amount * p_sw;
+    total = (int)((unsigned)amount * (unsigned)p_sw);
+    if ((total / p_sw) != amount)
+	return; /* multiplication overflow */
+
     oldp = ml_get_curline();
 
     if (!left)