patch 9.0.0483: illegal memory access when replacing in virtualedit mode
Problem: Illegal memory access when replacing in virtualedit mode.
Solution: Check for replacing NUL after Tab.
diff --git a/src/ops.c b/src/ops.c
index 88d85f8..99a5d5c 100644
--- a/src/ops.c
+++ b/src/ops.c
@@ -1173,6 +1173,8 @@
while (LTOREQ_POS(curwin->w_cursor, oap->end))
{
+ int done = FALSE;
+
n = gchar_cursor();
if (n != NUL)
{
@@ -1186,6 +1188,7 @@
if (curwin->w_cursor.lnum == oap->end.lnum)
oap->end.col += new_byte_len - old_byte_len;
replace_character(c);
+ done = TRUE;
}
else
{
@@ -1204,10 +1207,15 @@
if (curwin->w_cursor.lnum == oap->end.lnum)
getvpos(&oap->end, end_vcol);
}
- PBYTE(curwin->w_cursor, c);
+ // with "coladd" set may move to just after a TAB
+ if (gchar_cursor() != NUL)
+ {
+ PBYTE(curwin->w_cursor, c);
+ done = TRUE;
+ }
}
}
- else if (virtual_op && curwin->w_cursor.lnum == oap->end.lnum)
+ if (!done && virtual_op && curwin->w_cursor.lnum == oap->end.lnum)
{
int virtcols = oap->end.coladd;
diff --git a/src/testdir/test_virtualedit.vim b/src/testdir/test_virtualedit.vim
index 8fd6d98..8ca81a7 100644
--- a/src/testdir/test_virtualedit.vim
+++ b/src/testdir/test_virtualedit.vim
@@ -572,4 +572,18 @@
set virtualedit&
endfunc
+" this was replacing the NUL at the end of the line
+func Test_virtualedit_replace_after_tab()
+ new
+ s/\v/ 0
+ set ve=all
+ let @" = ''
+ sil! norm vPvr0
+
+ call assert_equal("\t0", getline(1))
+ set ve&
+ bwipe!
+endfunc
+
+
" vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 19f9e00..8b6367a 100644
--- a/src/version.c
+++ b/src/version.c
@@ -704,6 +704,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 483,
+/**/
482,
/**/
481,