patch 8.0.0305: invalid memory access when option has duplicate flag

Problem:    Invalid memory access when option has duplicate flag.
Solution:   Correct pointer computation. (Dominique Pelle, closes #1442)

diff --git a/src/option.c b/src/option.c
index 1237d048bac1c55352e0a55f846f1ae02a8e3364..32e97c99ba6e9acd98ae2e6d5e19b15dc8612548 100644 (file)
--- a/src/option.c
+++ b/src/option.c
@@ -4954,7 +4954,7 @@ do_set(
                            if (flags & P_FLAGLIST)
                            {
                                /* Remove flags that appear twice. */
-                               for (s = newval; *s; ++s)
+                               for (s = newval; *s;)
                                {
                                    /* if options have P_FLAGLIST and
                                     * P_ONECOMMA such as 'whichwrap' */
@@ -4966,7 +4966,7 @@ do_set(
                                            /* Remove the duplicated value and
                                             * the next comma. */
                                            STRMOVE(s, s + 2);
-                                           s -= 2;
+                                           continue;
                                        }
                                    }
                                    else
@@ -4975,9 +4975,10 @@ do_set(
                                              && vim_strchr(s + 1, *s) != NULL)
                                        {
                                            STRMOVE(s, s + 1);
-                                           --s;
+                                           continue;
                                        }
                                    }
+                                   ++s;
                                }
                            }
 

diff --git a/src/testdir/test_options.vim b/src/testdir/test_options.vim
index bfa942715d3b238583f005a61f69913f815642bd..ce59ae11b7f61f03f2b44d34c0cdff4ae2237972 100644 (file)
--- a/src/testdir/test_options.vim
+++ b/src/testdir/test_options.vim
@@ -13,6 +13,12 @@ function! Test_whichwrap()
   set whichwrap+=h,l
   call assert_equal('b,s,h,l', &whichwrap)
 
+  set whichwrap=h,h
+  call assert_equal('h', &whichwrap)
+
+  set whichwrap=h,h,h
+  call assert_equal('h', &whichwrap)
+
   set whichwrap&
 endfunction
 

diff --git a/src/version.c b/src/version.c
index 9273b2baa4dc3c9ffd005ea8b2e8d350dbee3a08..78cb27fe64755aaba07fa799175820abf6ff0efa 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -764,6 +764,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    305,
 /**/
     304,
 /**/