patch 9.0.0192: possible invalid memory access when 'cmdheight' is zero
Problem: Possible invalid memory access when 'cmdheight' is zero. (Martin
Tournoij)
Solution: Avoid going over the end of w_lines[] when w_height is Rows.
(closes #10882)
diff --git a/src/drawscreen.c b/src/drawscreen.c
index 578c66f..a5822b2 100644
--- a/src/drawscreen.c
+++ b/src/drawscreen.c
@@ -1808,9 +1808,13 @@
// Move the entries that were scrolled, disable
// the entries for the lines to be redrawn.
+ // Avoid using a wrong index when 'cmdheight' is
+ // zero and wp->w_height == Rows.
if ((wp->w_lines_valid += j) > wp->w_height)
wp->w_lines_valid = wp->w_height;
- for (idx = wp->w_lines_valid; idx - j >= 0; idx--)
+ for (idx = wp->w_lines_valid >= wp->w_height
+ ? wp->w_height - 1 : wp->w_lines_valid;
+ idx - j >= 0; idx--)
wp->w_lines[idx] = wp->w_lines[idx - j];
while (idx >= 0)
wp->w_lines[idx--].wl_valid = FALSE;
diff --git a/src/version.c b/src/version.c
index c899966..0369ad2 100644
--- a/src/version.c
+++ b/src/version.c
@@ -736,6 +736,8 @@
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
+ 192,
+/**/
191,
/**/
190,