patch 8.2.2243: crash when popup mask contains zeroes

Problem:    Crash when popup mask contains zeroes.
Solution:   Check boundaries properly. (closes #7569)

diff --git a/src/popupwin.c b/src/popupwin.c
index 13a455d4ecc7cb92507ae52eda2ce14a03f3d1b5..7896efd2100fd0fe361f0ed769cb531e999336e2 100644 (file)
--- a/src/popupwin.c
+++ b/src/popupwin.c
@@ -3346,21 +3346,29 @@ popup_update_mask(win_T *wp, int width, int height)
        cols = tv_get_number(&li->li_tv);
        if (cols < 0)
            cols = width + cols + 1;
+       if (cols <= 0)
+           cols = 1;
        li = li->li_next;
        cole = tv_get_number(&li->li_tv);
        if (cole < 0)
            cole = width + cole + 1;
+       if (cole > width)
+           cole = width;
        li = li->li_next;
        lines = tv_get_number(&li->li_tv);
        if (lines < 0)
            lines = height + lines + 1;
+       if (lines <= 0)
+           lines = 1;
        li = li->li_next;
        linee = tv_get_number(&li->li_tv);
        if (linee < 0)
            linee = height + linee + 1;
+       if (linee > height)
+           linee = height;
 
-       for (row = lines - 1; row < linee && row < height; ++row)
-           for (col = cols - 1; col < cole && col < width; ++col)
+       for (row = lines - 1; row < linee; ++row)
+           for (col = cols - 1; col < cole; ++col)
                cells[row * width + col] = 1;
     }
 }

diff --git a/src/testdir/test_popupwin.vim b/src/testdir/test_popupwin.vim
index b8641fe7d2b37ef5769a8f1cddc4cd0baa7d0727..bfc049438a06357faca20a6f58cb20bc03ee8204 100644 (file)
--- a/src/testdir/test_popupwin.vim
+++ b/src/testdir/test_popupwin.vim
@@ -821,6 +821,10 @@ func Test_popup_with_mask()
   " clean up
   call StopVimInTerminal(buf)
   call delete('XtestPopupMask')
+
+  " this was causing a crash
+  call popup_create('test', #{mask: [[0, 0, 0, 0]]})
+  call popup_clear()
 endfunc
 
 func Test_popup_select()

diff --git a/src/version.c b/src/version.c
index ee0d9878caf574c1e70a0976b03e1fca39815842..6c6d8c640c3a3b5a9f12cdea672f04941f9199ea 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2243,
 /**/
     2242,
 /**/