patch 9.1.1262: heap-buffer-overflow with narrow 'pummaxwidth' value
Problem: heap-buffer-overflow occurs with narrow 'pummaxwidth' value
(after v9.1.1250)
Solution: test that st_end points after st pointer (Hirohito Higashi)
closes: #17005
Signed-off-by: Hirohito Higashi <h.east.727@gmail.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
diff --git a/src/popupmenu.c b/src/popupmenu.c
index 71bb499..a7c20c1 100644
--- a/src/popupmenu.c
+++ b/src/popupmenu.c
@@ -845,7 +845,7 @@
last_char = st_end;
}
- if (last_char != NULL)
+ if (last_char != NULL && st_end > st)
{
if (used_cells < ellipsis_width)
{