patch 9.1.0413: smoothscroll may cause infinite loop
Problem: smoothscroll may cause infinite loop, with
very narrow windows
(Jaehwang Jung, after v9.1.0280)
Solution: Check for width1 being negative, verify
that win_linetabsize does not overflow
fixes: #14750
closes: #14772
Co-authored-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/charset.c b/src/charset.c
index 470698f..9aa402a 100644
--- a/src/charset.c
+++ b/src/charset.c
@@ -765,10 +765,22 @@
linetabsize_col(int startcol, char_u *s)
{
chartabsize_T cts;
+ vimlong_T vcol;
init_chartabsize_arg(&cts, curwin, 0, startcol, s, s);
+ vcol = cts.cts_vcol;
+
while (*cts.cts_ptr != NUL)
- cts.cts_vcol += lbr_chartabsize_adv(&cts);
+ {
+ vcol += lbr_chartabsize_adv(&cts);
+ if (vcol > MAXCOL)
+ {
+ cts.cts_vcol = MAXCOL;
+ break;
+ }
+ else
+ cts.cts_vcol = (int)vcol;
+ }
clear_chartabsize_arg(&cts);
return (int)cts.cts_vcol;
}
@@ -840,22 +852,33 @@
void
win_linetabsize_cts(chartabsize_T *cts, colnr_T len)
{
+ vimlong_T vcol = cts->cts_vcol;
#ifdef FEAT_PROP_POPUP
cts->cts_with_trailing = len == MAXCOL;
#endif
for ( ; *cts->cts_ptr != NUL && (len == MAXCOL || cts->cts_ptr < cts->cts_line + len);
MB_PTR_ADV(cts->cts_ptr))
- cts->cts_vcol += win_lbr_chartabsize(cts, NULL);
+ {
+ vcol += win_lbr_chartabsize(cts, NULL);
+ if (vcol > MAXCOL)
+ {
+ cts->cts_vcol = MAXCOL;
+ break;
+ }
+ else
+ cts->cts_vcol = (int)vcol;
+ }
#ifdef FEAT_PROP_POPUP
// check for a virtual text at the end of a line or on an empty line
if (len == MAXCOL && cts->cts_has_prop_with_text && *cts->cts_ptr == NUL)
{
(void)win_lbr_chartabsize(cts, NULL);
- cts->cts_vcol += cts->cts_cur_text_width;
+ vcol += cts->cts_cur_text_width;
// when properties are above or below the empty line must also be
// counted
if (cts->cts_ptr == cts->cts_line && cts->cts_prop_lines > 0)
- ++cts->cts_vcol;
+ ++vcol;
+ cts->cts_vcol = vcol > MAXCOL ? MAXCOL : (int)vcol;
}
#endif
}