patch 8.0.0324: illegal memory access with a wrong yank range

Problem:    Illegal memory access with "1;y".
Solution:   Call check_cursor() instead of check_cursor_lnum(). (Dominique
            Pelle, closes #1455)

diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index 3ee7056c1254b4b9ad3700f24963b79441bd20ee..09102b537006dcde443b0f48c6beed028242a039 100644 (file)
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -2295,8 +2295,8 @@ do_one_cmd(
            if (!ea.skip)
            {
                curwin->w_cursor.lnum = ea.line2;
-               /* don't leave the cursor on an illegal line */
-               check_cursor_lnum();
+               /* don't leave the cursor on an illegal line or column */
+               check_cursor();
            }
        }
        else if (*ea.cmd != ',')

diff --git a/src/testdir/test_cmdline.vim b/src/testdir/test_cmdline.vim
index b2beb689b188e1ef60da36163ad7b3f8e3e519d4..05beb45c9879f4fc8e79d34899a6862b13ebd9a5 100644 (file)
--- a/src/testdir/test_cmdline.vim
+++ b/src/testdir/test_cmdline.vim
@@ -289,13 +289,24 @@ func Test_remove_char_in_cmdline()
   call assert_equal('"def', @:)
 endfunc
 
-func Test_illegal_address()
+func Test_illegal_address1()
   new
   2;'(
   2;')
   quit
 endfunc
 
+func Test_illegal_address2()
+  call writefile(['c', 'x', '  x', '.', '1;y'], 'Xtest.vim')
+  new
+  source Xtest.vim
+  " Trigger calling validate_cursor()
+  diffsp Xtest.vim
+  quit!
+  bwipe!
+  call delete('Xtest.vim')
+endfunc
+
 func Test_cmdline_complete_wildoptions()
   help
   call feedkeys(":tag /\<c-a>\<c-b>\"\<cr>", 'tx')

diff --git a/src/version.c b/src/version.c
index a6dbe99462f8c8fe5b49f8c707b470e71cdb9f37..d174d035d1445643b138fbd65d0aaa2e7dcba301 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -764,6 +764,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    324,
 /**/
     323,
 /**/