patch 8.2.1220: memory access error when dragging a popup window

Problem:    memory access error when dragging a popup window over a buffer
            with folding.
Solution:   Avoid going over the end of the cache. (closes #6438)

diff --git a/src/mouse.c b/src/mouse.c
index 095417e35b2bed4f4f5ed0c7b6ed1ecc91b4f095..56472a3f05b2ff0f5ea363c8821cefeeeb2c75db 100644 (file)
--- a/src/mouse.c
+++ b/src/mouse.c
@@ -2839,10 +2839,10 @@ check_termcode_mouse(
 /*
  * Compute the buffer line position from the screen position "rowp" / "colp" in
  * window "win".
- * "plines_cache" can be NULL (no cache) or an array with "win->w_height"
- * entries that caches the plines_win() result from a previous call.  Entry is
- * zero if not computed yet.  There must be no text or setting changes since
- * the entry is put in the cache.
+ * "plines_cache" can be NULL (no cache) or an array with "Rows" entries that
+ * caches the plines_win() result from a previous call.  Entry is zero if not
+ * computed yet.  There must be no text or setting changes since the entry is
+ * put in the cache.
  * Returns TRUE if the position is below the last line.
  */
     int
@@ -2871,7 +2871,10 @@ mouse_comp_pos(
     {
        int cache_idx = lnum - win->w_topline;
 
-       if (plines_cache != NULL && plines_cache[cache_idx] > 0)
+       // Only "Rows" lines are cached, with folding we'll run out of entries
+       // and use the slow way.
+       if (plines_cache != NULL && cache_idx < Rows
+                                               && plines_cache[cache_idx] > 0)
            count = plines_cache[cache_idx];
        else
        {
@@ -2892,7 +2895,7 @@ mouse_comp_pos(
            else
 #endif
                count = plines_win(win, lnum, TRUE);
-           if (plines_cache != NULL)
+           if (plines_cache != NULL && cache_idx < Rows)
                plines_cache[cache_idx] = count;
        }
        if (count > row)

diff --git a/src/testdir/dumps/Test_popupwin_term_01.dump b/src/testdir/dumps/Test_popupwin_term_01.dump
index 473c991c8621d1b137f2206c7f143154dcaa2c96..50818c15b96b751f05342679e98805b0f1ed470e 100644 (file)
--- a/src/testdir/dumps/Test_popupwin_term_01.dump
+++ b/src/testdir/dumps/Test_popupwin_term_01.dump
@@ -3,8 +3,14 @@
 @34|╔+0#0000001#ffd7ff255|═@3|╗| +0#0000000#ffffff0@34
 @34|║+0#0000001#ffd7ff255|1@3|║| +0#0000000#ffffff0@34
 |!+0#ffffff16#00e0003|/|b|i|n|/|s|h| |[|r|u|n@1|i|n|g|]| @15|║+0#0000001#ffd7ff255|2@3|║| +0#ffffff16#00e0003@34
-> +0#0000000#ffffff0@33|╚+0#0000001#ffd7ff255|═@3|⇲| +0#0000000#ffffff0@34
-|~+0#4040ff13&| @73
-|~| @73
-|[+3#0000000&|N|o| |N|a|m|e|]| @65
+>++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |f|o|l|d| |-@14|╚+0#0000001#ffd7ff255|═@3|⇲|-+0#0000e05#a8a8a8255@34
+|1+0#0000000#ffffff0@1| @72
+|++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |f|o|l|d| |-@55
+|2+0#0000000#ffffff0|3| @72
+|++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |f|o|l|d| |-@55
+|3+0#0000000#ffffff0|5| @72
+|++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |f|o|l|d| |-@55
+|4+0#0000000#ffffff0|7| @72
+|++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |f|o|l|d| |-@55
+|[+3#0000000#ffffff0|N|o| |N|a|m|e|]| |[|+|]| @61
 | +0&&@74

diff --git a/src/testdir/dumps/Test_popupwin_term_02.dump b/src/testdir/dumps/Test_popupwin_term_02.dump
index afa330f326f428babf6c604df2d2170aecea76ca..160834aa5d3a727a1e23403f0c2115c9db0742da 100644 (file)
--- a/src/testdir/dumps/Test_popupwin_term_02.dump
+++ b/src/testdir/dumps/Test_popupwin_term_02.dump
@@ -3,8 +3,14 @@
 @14|╔+0#0000001#ffd7ff255|═@3|╗| +0#0000000#ffffff0@54
 @14|║+0#0000001#ffd7ff255|1@3|║| +0#0000000#ffffff0@54
 |!+0#ffffff16#00e0003|/|b|i|n|/|s|h| |[|r|u|n@1|║+0#0000001#ffd7ff255|2@3|║| +0#ffffff16#00e0003@54
-> +0#0000000#ffffff0@13|╚+0#0000001#ffd7ff255|═@3|⇲| +0#0000000#ffffff0@54
-|~+0#4040ff13&| @73
-|~| @73
-|[+3#0000000&|N|o| |N|a|m|e|]| @65
-|:+0&&|c|a|l@1| |D|r|a|g|i|t|(|)| @60
+>++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |╚+0#0000001#ffd7ff255|═@3|⇲|-+0#0000e05#a8a8a8255@54
+|1+0#0000000#ffffff0@1| @72
+|++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |f|o|l|d| |-@55
+|2+0#0000000#ffffff0|3| @72
+|++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |f|o|l|d| |-@55
+|3+0#0000000#ffffff0|5| @72
+|++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |f|o|l|d| |-@55
+|4+0#0000000#ffffff0|7| @72
+|++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |f|o|l|d| |-@55
+|[+3#0000000#ffffff0|N|o| |N|a|m|e|]| |[|+|]| @61
+|:+0&&|c|a|l@1| |D|r|a|g|i|t|L|e|f|t|(|)| @56

diff --git a/src/testdir/dumps/Test_popupwin_term_03.dump b/src/testdir/dumps/Test_popupwin_term_03.dump
new file mode 100644 (file)
index 0000000..0632ee8
--- /dev/null
+++ b/src/testdir/dumps/Test_popupwin_term_03.dump
@@ -0,0 +1,16 @@
+|v+0&#ffffff0|i|m|>| @70
+@75
+@75
+@75
+|!+0#ffffff16#00e0003|/|b|i|n|/|s|h| |[|r|u|n@1|i|n|g|]| @56
+>++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |f|o|l|d| |-@55
+|1+0#0000000#ffffff0@1| @72
+|++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |f|o|l|d| |-@55
+|2+0#0000000#ffffff0|3| @72
+|++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |f|o|l|d| |-@55
+|3+0#0000000#ffffff0|5| @72
+|++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |f|o|l|d| |-@14|╔+0#0000001#ffd7ff255|═@3|╗|-+0#0000e05#a8a8a8255@34
+|4+0#0000000#ffffff0|7| @31|║+0#0000001#ffd7ff255|1@3|║| +0#0000000#ffffff0@34
+|++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |f|o|l|d| |-@14|║+0#0000001#ffd7ff255|2@3|║|-+0#0000e05#a8a8a8255@34
+|[+3#0000000#ffffff0|N|o| |N|a|m|e|]| |[|+|]| @20|╚+0#0000001#ffd7ff255|═@3|⇲| +3#0000000#ffffff0@34
+|:+0&&|c|a|l@1| |D|r|a|g|i|t|D|o|w|n|(|)| @56

diff --git a/src/testdir/dumps/Test_popupwin_term_04.dump b/src/testdir/dumps/Test_popupwin_term_04.dump
new file mode 100644 (file)
index 0000000..1345b75
--- /dev/null
+++ b/src/testdir/dumps/Test_popupwin_term_04.dump
@@ -0,0 +1,16 @@
+|v+0&#ffffff0|i|m|>| @70
+@75
+@75
+@75
+|!+0#ffffff16#00e0003|/|b|i|n|/|s|h| |[|r|u|n@1|i|n|g|]| @56
+>++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |f|o|l|d| |-@55
+|1+0#0000000#ffffff0@1| @72
+|++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |f|o|l|d| |-@55
+|2+0#0000000#ffffff0|3| @72
+|++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |f|o|l|d| |-@55
+|3+0#0000000#ffffff0|5| @72
+|++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |╔+0#0000001#ffd7ff255|═@3|╗|-+0#0000e05#a8a8a8255@54
+|4+0#0000000#ffffff0|7| @11|║+0#0000001#ffd7ff255|1@3|║| +0#0000000#ffffff0@54
+|++0#0000e05#a8a8a8255|-@1| |1@1| |l|i|n|e|s|:| |║+0#0000001#ffd7ff255|2@3|║|-+0#0000e05#a8a8a8255@54
+|[+3#0000000#ffffff0|N|o| |N|a|m|e|]| |[|+|]| |╚+0#0000001#ffd7ff255|═@3|⇲| +3#0000000#ffffff0@54
+|:+0&&|c|a|l@1| |D|r|a|g|i|t|D|o|w|n|L|e|f|t|(|)| @52

diff --git a/src/testdir/test_popupwin.vim b/src/testdir/test_popupwin.vim
index 45f55f55b20b29908aec8f4796c8172df09de045..8df01e15a6e795de333772c66507447e1c199736 100644 (file)
--- a/src/testdir/test_popupwin.vim
+++ b/src/testdir/test_popupwin.vim
@@ -584,9 +584,16 @@ func Test_popup_drag_termwin()
 
   " create a popup that covers the terminal window
   let lines =<< trim END
+       set foldmethod=marker
+       call setline(1, range(100))
+       for nr in range(7)
+         call setline(nr * 12 + 1, "fold {{{")
+         call setline(nr * 12 + 11 , "end }}}")
+       endfor
+       %foldclose
        set shell=/bin/sh noruler
        let $PS1 = 'vim> '
-        terminal
+        terminal ++rows=4
        $wincmd w
        let winid = popup_create(['1111', '2222'], #{
              \ drag: 1,
@@ -594,19 +601,33 @@ func Test_popup_drag_termwin()
              \ border: [],
              \ line: 3,
              \ })
-       func Dragit()
+       func DragitLeft()
          call feedkeys("\<F3>\<LeftMouse>\<F4>\<LeftDrag>\<LeftRelease>", "xt")
        endfunc
+       func DragitDown()
+         call feedkeys("\<F4>\<LeftMouse>\<F5>\<LeftDrag>\<LeftRelease>", "xt")
+       endfunc
+       func DragitDownLeft()
+         call feedkeys("\<F5>\<LeftMouse>\<F6>\<LeftDrag>\<LeftRelease>", "xt")
+       endfunc
        map <silent> <F3> :call test_setmouse(3, &columns / 2)<CR>
        map <silent> <F4> :call test_setmouse(3, &columns / 2 - 20)<CR>
+       map <silent> <F5> :call test_setmouse(12, &columns / 2)<CR>
+       map <silent> <F6> :call test_setmouse(12, &columns / 2 - 20)<CR>
   END
   call writefile(lines, 'XtestPopupTerm')
-  let buf = RunVimInTerminal('-S XtestPopupTerm', #{rows: 10})
+  let buf = RunVimInTerminal('-S XtestPopupTerm', #{rows: 16})
   call VerifyScreenDump(buf, 'Test_popupwin_term_01', {})
 
-  call term_sendkeys(buf, ":call Dragit()\<CR>")
+  call term_sendkeys(buf, ":call DragitLeft()\<CR>")
   call VerifyScreenDump(buf, 'Test_popupwin_term_02', {})
 
+  call term_sendkeys(buf, ":call DragitDown()\<CR>")
+  call VerifyScreenDump(buf, 'Test_popupwin_term_03', {})
+
+  call term_sendkeys(buf, ":call DragitDownLeft()\<CR>")
+  call VerifyScreenDump(buf, 'Test_popupwin_term_04', {})
+
   " clean up
   call StopVimInTerminal(buf)
   call delete('XtestPopupTerm')

diff --git a/src/version.c b/src/version.c
index eff78356b614f6fc378978d120c443cb9b958b91..424234b9a05abfdd9e704fd6c85059bec1a20de0 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -754,6 +754,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1220,
 /**/
     1219,
 /**/