patch 8.0.1346: crash when passing 50 char string to balloon_split()

Problem:    Crash when passing 50 char string to balloon_split().
Solution:   Fix off-by-one error.

diff --git a/src/popupmnu.c b/src/popupmnu.c
index 77460a1a6c4a22ba9060993fd1eea75609d936f0..447f789e5964a2e1a4d15c30909c32450c33c407 100644 (file)
--- a/src/popupmnu.c
+++ b/src/popupmnu.c
@@ -836,7 +836,7 @@ split_message(char_u *mesg, pumitem_T **array)
        item->bytelen = p - item->start;
        if (item->cells > max_cells)
            max_cells = item->cells;
-       long_item_count += item->cells / BALLOON_MIN_WIDTH;
+       long_item_count += (item->cells - 1) / BALLOON_MIN_WIDTH;
     }
 
     height = 2 + ga.ga_len;

diff --git a/src/testdir/test_popup.vim b/src/testdir/test_popup.vim
index 2bb9b32c4935668df453a54a846fc51708d91a93..6250c1b8f2fd9fc2f4379a95a88ea47c3b9cf61e 100644 (file)
--- a/src/testdir/test_popup.vim
+++ b/src/testdir/test_popup.vim
@@ -707,6 +707,10 @@ func Test_balloon_split()
   if !exists('*balloon_split')
     return
   endif
+  call assert_equal([
+        \ 'tempname: 0x555555e380a0 "/home/mool/.viminfz.tmp"',
+        \ ], balloon_split(
+        \ 'tempname: 0x555555e380a0 "/home/mool/.viminfz.tmp"'))
   call assert_equal([
         \ 'one two three four one two three four one two thre',
         \ 'e four',

diff --git a/src/version.c b/src/version.c
index 5b3b7977ba56e432e5ef3667be5223daf068d02e..55754faa02d30820f16c5c596414e1abc47dd09b 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -771,6 +771,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1346,
 /**/
     1345,
 /**/