patch 9.0.0483: illegal memory access when replacing in virtualedit mode

Problem:    Illegal memory access when replacing in virtualedit mode.
Solution:   Check for replacing NUL after Tab.

diff --git a/src/ops.c b/src/ops.c
index 88d85f8e0b312676d0e7018e7c2d618e35db282e..99a5d5cdfd4d7e8dc800f0b9041a158b58aceb3c 100644 (file)
--- a/src/ops.c
+++ b/src/ops.c
@@ -1173,6 +1173,8 @@ op_replace(oparg_T *oap, int c)
 
        while (LTOREQ_POS(curwin->w_cursor, oap->end))
        {
+           int done = FALSE;
+
            n = gchar_cursor();
            if (n != NUL)
            {
@@ -1186,6 +1188,7 @@ op_replace(oparg_T *oap, int c)
                    if (curwin->w_cursor.lnum == oap->end.lnum)
                        oap->end.col += new_byte_len - old_byte_len;
                    replace_character(c);
+                   done = TRUE;
                }
                else
                {
@@ -1204,10 +1207,15 @@ op_replace(oparg_T *oap, int c)
                        if (curwin->w_cursor.lnum == oap->end.lnum)
                            getvpos(&oap->end, end_vcol);
                    }
-                   PBYTE(curwin->w_cursor, c);
+                   // with "coladd" set may move to just after a TAB
+                   if (gchar_cursor() != NUL)
+                   {
+                       PBYTE(curwin->w_cursor, c);
+                       done = TRUE;
+                   }
                }
            }
-           else if (virtual_op && curwin->w_cursor.lnum == oap->end.lnum)
+           if (!done && virtual_op && curwin->w_cursor.lnum == oap->end.lnum)
            {
                int virtcols = oap->end.coladd;
 

diff --git a/src/testdir/test_virtualedit.vim b/src/testdir/test_virtualedit.vim
index 8fd6d984470f4d7540cd80cd30f88610dd35cf48..8ca81a777d2622892ce2bb003c48733c0bfc2dc3 100644 (file)
--- a/src/testdir/test_virtualedit.vim
+++ b/src/testdir/test_virtualedit.vim
@@ -572,4 +572,18 @@ func Test_virtualedit_mouse()
   set virtualedit&
 endfunc
 
+" this was replacing the NUL at the end of the line 
+func Test_virtualedit_replace_after_tab()
+  new
+  s/\v/        0
+  set ve=all
+  let @" = ''
+  sil! norm vPvr0
+  
+  call assert_equal("\t0", getline(1))
+  set ve&
+  bwipe!
+endfunc
+
+
 " vim: shiftwidth=2 sts=2 expandtab

diff --git a/src/version.c b/src/version.c
index 19f9e00ec97d28524edf66ff893458940385471e..8b6367ac9373024903eda2ba44a79200850d4084 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -703,6 +703,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    483,
 /**/
     482,
 /**/