patch 8.0.0357: crash when setting 'guicursor' to weird value

Problem:    Crash when setting 'guicursor' to weird value.
Solution:   Avoid negative size. (Dominique Pelle, closes #1465)

diff --git a/src/misc2.c b/src/misc2.c
index 71ca6d8f5ba6df42fe074b27a0e73c40e591b61a..992e5c29295ffc8fd87a2bac13d5fda99cf30a35 100644 (file)
--- a/src/misc2.c
+++ b/src/misc2.c
@@ -3472,11 +3472,12 @@ parse_shape_opt(int what)
        while (*modep != NUL)
        {
            colonp = vim_strchr(modep, ':');
-           if (colonp == NULL)
+           commap = vim_strchr(modep, ',');
+
+           if (colonp == NULL || (commap != NULL && commap < colonp))
                return (char_u *)N_("E545: Missing colon");
            if (colonp == modep)
                return (char_u *)N_("E546: Illegal mode");
-           commap = vim_strchr(modep, ',');
 
            /*
             * Repeat for all mode's before the colon.

diff --git a/src/testdir/test_options.vim b/src/testdir/test_options.vim
index 11466dc16ac9667a55779b024448b36cd5d690cd..1ee1f8fa8102db26823b3570880bf0a353da2ea9 100644 (file)
--- a/src/testdir/test_options.vim
+++ b/src/testdir/test_options.vim
@@ -235,7 +235,14 @@ func Test_set_errors()
   call assert_fails('set statusline=%{', 'E540:')
   call assert_fails('set statusline=' . repeat("%p", 81), 'E541:')
   call assert_fails('set statusline=%(', 'E542:')
-  call assert_fails('set guicursor=x', 'E545:')
+  if has('cursorshape')
+    " This invalid value for 'guicursor' used to cause Vim to crash.
+    call assert_fails('set guicursor=i-ci,r-cr:h', 'E545:')
+    call assert_fails('set guicursor=i-ci', 'E545:')
+    call assert_fails('set guicursor=x', 'E545:')
+    call assert_fails('set guicursor=r-cr:horx', 'E548:')
+    call assert_fails('set guicursor=r-cr:hor0', 'E549:')
+  endif
   call assert_fails('set backupext=~ patchmode=~', 'E589:')
   call assert_fails('set winminheight=10 winheight=9', 'E591:')
   call assert_fails('set winminwidth=10 winwidth=9', 'E592:')

diff --git a/src/version.c b/src/version.c
index 94a325beb5acb7bf8aed4d5d29105a74729d55ac..2d076cc14c72b42b4dec4568448a046436ff3491 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -764,6 +764,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    357,
 /**/
     356,
 /**/