From: Bram Moolenaar <Bram@vim.org>
Date: Tue, 29 Dec 2020 10:57:46 +0000 (+0100)
Subject: patch 8.2.2243: crash when popup mask contains zeroes
X-Git-Tag: v8.2.2243
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=4012d262072a3ac95878c9d061fa985301720ec2;p=vim

patch 8.2.2243: crash when popup mask contains zeroes

Problem:    Crash when popup mask contains zeroes.
Solution:   Check boundaries properly. (closes #7569)
---

diff --git a/src/popupwin.c b/src/popupwin.c
index 13a455d4e..7896efd21 100644
--- a/src/popupwin.c
+++ b/src/popupwin.c
@@ -3346,21 +3346,29 @@ popup_update_mask(win_T *wp, int width, int height)
 	cols = tv_get_number(&li->li_tv);
 	if (cols < 0)
 	    cols = width + cols + 1;
+	if (cols <= 0)
+	    cols = 1;
 	li = li->li_next;
 	cole = tv_get_number(&li->li_tv);
 	if (cole < 0)
 	    cole = width + cole + 1;
+	if (cole > width)
+	    cole = width;
 	li = li->li_next;
 	lines = tv_get_number(&li->li_tv);
 	if (lines < 0)
 	    lines = height + lines + 1;
+	if (lines <= 0)
+	    lines = 1;
 	li = li->li_next;
 	linee = tv_get_number(&li->li_tv);
 	if (linee < 0)
 	    linee = height + linee + 1;
+	if (linee > height)
+	    linee = height;
 
-	for (row = lines - 1; row < linee && row < height; ++row)
-	    for (col = cols - 1; col < cole && col < width; ++col)
+	for (row = lines - 1; row < linee; ++row)
+	    for (col = cols - 1; col < cole; ++col)
 		cells[row * width + col] = 1;
     }
 }
diff --git a/src/testdir/test_popupwin.vim b/src/testdir/test_popupwin.vim
index b8641fe7d..bfc049438 100644
--- a/src/testdir/test_popupwin.vim
+++ b/src/testdir/test_popupwin.vim
@@ -821,6 +821,10 @@ func Test_popup_with_mask()
   " clean up
   call StopVimInTerminal(buf)
   call delete('XtestPopupMask')
+
+  " this was causing a crash
+  call popup_create('test', #{mask: [[0, 0, 0, 0]]})
+  call popup_clear()
 endfunc
 
 func Test_popup_select()
diff --git a/src/version.c b/src/version.c
index ee0d9878c..6c6d8c640 100644
--- a/src/version.c
+++ b/src/version.c
@@ -750,6 +750,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    2243,
 /**/
     2242,
 /**/