patch 9.0.0192: possible invalid memory access when 'cmdheight' is zero

Problem:    Possible invalid memory access when 'cmdheight' is zero. (Martin
            Tournoij)
Solution:   Avoid going over the end of w_lines[] when w_height is Rows.
            (closes #10882)

diff --git a/src/drawscreen.c b/src/drawscreen.c
index 578c66f2b9d39240ff08bbfc10a46be1479930b1..a5822b25d876c31c81eacf75f7a4ac3d9d6a6a79 100644 (file)
--- a/src/drawscreen.c
+++ b/src/drawscreen.c
@@ -1808,9 +1808,13 @@ win_update(win_T *wp)
 
                            // Move the entries that were scrolled, disable
                            // the entries for the lines to be redrawn.
+                           // Avoid using a wrong index when 'cmdheight' is
+                           // zero and wp->w_height == Rows.
                            if ((wp->w_lines_valid += j) > wp->w_height)
                                wp->w_lines_valid = wp->w_height;
-                           for (idx = wp->w_lines_valid; idx - j >= 0; idx--)
+                           for (idx = wp->w_lines_valid >= wp->w_height
+                                   ? wp->w_height - 1 : wp->w_lines_valid;
+                                                          idx - j >= 0; idx--)
                                wp->w_lines[idx] = wp->w_lines[idx - j];
                            while (idx >= 0)
                                wp->w_lines[idx--].wl_valid = FALSE;

diff --git a/src/version.c b/src/version.c
index c89996625677d9078084c715c687ef8b32f6ed3d..0369ad2003737dc29e0c8536538f3bb04a0281c6 100644 (file)
--- a/src/version.c
+++ b/src/version.c
@@ -735,6 +735,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    192,
 /**/
     191,
 /**/