patch 9.0.0309: invalid memory access when cmdheight is zero

Problem:    Invalid memory access when cmdheight is zero.
Solution:   Check index in w_lines is smaller than Rows.

diff --git a/src/drawscreen.c b/src/drawscreen.c
index de091e81d8ca6799a697fb12a874d162b25042e7..aa5b8f7eb7dddf0dd801b1e75387a960e1d008f8 100644 (file)
--- a/src/drawscreen.c
+++ b/src/drawscreen.c
@@ -830,6 +830,9 @@ after_updating_screen(int may_resize_shell UNUSED)
     // handle the drop now.
     handle_any_postponed_drop();
 #endif
+
+    // in case it was changed in dont_use_message_window()
+    cmdline_row = Rows - p_ch;
 }
 
 /*
@@ -2426,7 +2429,8 @@ win_update(win_T *wp)
                            if (wp->w_lines_valid > wp->w_height)
                                wp->w_lines_valid = wp->w_height;
                            for (i = wp->w_lines_valid; i - j >= idx; --i)
-                               wp->w_lines[i] = wp->w_lines[i - j];
+                               if (i < Rows)
+                                   wp->w_lines[i] = wp->w_lines[i - j];
 
                            // The w_lines[] entries for inserted lines are
                            // now invalid, but wl_size may be used above.

diff --git a/src/version.c b/src/version.c
index eb05f9a0c4fe6b8ef2459e7573404e3407419186..c69e46c491bdff7961609356f38eb3a01dd1684f 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -707,6 +707,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    309,
 /**/
     308,
 /**/