patch 8.2.1537: memory acccess error when using setcellwidths()

Problem:    Memory acccess error when using setcellwidths().
Solution:   Use array and pointers correctly.

diff --git a/src/errors.h b/src/errors.h
index 4b3e5debe86151e09f984f8650226b4306b59a12..4db134251c06d3c64b9732e7ac72a976efefd1d1 100644 (file)
--- a/src/errors.h
+++ b/src/errors.h
@@ -247,7 +247,7 @@ EXTERN char e_list_item_nr_range_invalid[]
 EXTERN char e_list_item_nr_cell_width_invalid[]
        INIT(= N_("E1112: List item %d cell width invalid"));
 EXTERN char e_overlapping_ranges_for_nr[]
-       INIT(= N_("E1113: Overlapping ranges for %lx"));
+       INIT(= N_("E1113: Overlapping ranges for 0x%lx"));
 EXTERN char e_only_values_of_0x100_and_higher_supported[]
        INIT(= N_("E1114: Only values of 0x100 and higher supported"));
 #endif

diff --git a/src/mbyte.c b/src/mbyte.c
index 3faefa6af66f15ded4bed917f6458309fe0540fb..46d0392489a445a1363aeeffa52e2934173fcd28 100644 (file)
--- a/src/mbyte.c
+++ b/src/mbyte.c
@@ -5421,8 +5421,8 @@ cw_value(int c)
     static int
 tv_nr_compare(const void *a1, const void *a2)
 {
-    listitem_T *li1 = (listitem_T *)a1;
-    listitem_T *li2 = (listitem_T *)a2;
+    listitem_T *li1 = *(listitem_T **)a1;
+    listitem_T *li2 = *(listitem_T **)a2;
 
     return li1->li_tv.vval.v_number - li2->li_tv.vval.v_number;
 }
@@ -5470,8 +5470,10 @@ f_setcellwidths(typval_T *argvars, typval_T *rettv UNUSED)
            vim_free(ptrs);
            return;
        }
-       for (lili = li->li_tv.vval.v_list->lv_first, i = 0; lili != NULL;
-                                                    lili = lili->li_next, ++i)
+
+       lili = li->li_tv.vval.v_list->lv_first;
+       ptrs[item] = lili;
+       for (i = 0; lili != NULL; lili = lili->li_next, ++i)
        {
            if (lili->li_tv.v_type != VAR_NUMBER)
                break;
@@ -5505,7 +5507,7 @@ f_setcellwidths(typval_T *argvars, typval_T *rettv UNUSED)
            vim_free(ptrs);
            return;
        }
-       ptrs[item++] = lili;
+       ++item;
     }
 
     // Sort the list on the first number.
@@ -5520,9 +5522,9 @@ f_setcellwidths(typval_T *argvars, typval_T *rettv UNUSED)
 
     // Store the items in the new table.
     item = 0;
-    for (li = l->lv_first; li != NULL; li = li->li_next)
+    for (item = 0; item < l->lv_len; ++item)
     {
-       listitem_T      *lili = li->li_tv.vval.v_list->lv_first;
+       listitem_T      *lili = ptrs[item];
        varnumber_T     n1;
 
        n1 = lili->li_tv.vval.v_number;
@@ -5538,7 +5540,6 @@ f_setcellwidths(typval_T *argvars, typval_T *rettv UNUSED)
        table[item].last = lili->li_tv.vval.v_number;
        lili = lili->li_next;
        table[item].width = lili->li_tv.vval.v_number;
-       ++item;
     }
 
     vim_free(ptrs);

diff --git a/src/testdir/test_utf8.vim b/src/testdir/test_utf8.vim
index b2b74599d5365be968a61ae77e875d0a2a695714..a1e97fd70b62cdd3d0d802eb0df6dcaf7b9d6cca 100644 (file)
--- a/src/testdir/test_utf8.vim
+++ b/src/testdir/test_utf8.vim
@@ -148,8 +148,8 @@ endfunc
 func Test_setcellwidths()
   call setcellwidths([
         \ [0x1330, 0x1330, 2],
-        \ [0x1337, 0x1339, 2],
         \ [9999, 10000, 1],
+        \ [0x1337, 0x1339, 2],
         \])
 
   call assert_equal(2, strwidth("\u1330"))

diff --git a/src/version.c b/src/version.c
index 92e90fe21c1158e61e33afef42ef3beb208f2b92..d4d525bbdde5bf654c79c91dda0253454819a963 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -754,6 +754,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1537,
 /**/
     1536,
 /**/