From: Bram Moolenaar <Bram@vim.org>
Date: Sun, 5 Feb 2017 13:13:20 +0000 (+0100)
Subject: patch 8.0.0305: invalid memory access when option has duplicate flag
X-Git-Tag: v8.0.0305
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=aaaf57d8a936efe420190c077e4a74041cc6c72e;p=vim

patch 8.0.0305: invalid memory access when option has duplicate flag

Problem:    Invalid memory access when option has duplicate flag.
Solution:   Correct pointer computation. (Dominique Pelle, closes #1442)
---

diff --git a/src/option.c b/src/option.c
index 1237d048b..32e97c99b 100644
--- a/src/option.c
+++ b/src/option.c
@@ -4954,7 +4954,7 @@ do_set(
 			    if (flags & P_FLAGLIST)
 			    {
 				/* Remove flags that appear twice. */
-				for (s = newval; *s; ++s)
+				for (s = newval; *s;)
 				{
 				    /* if options have P_FLAGLIST and
 				     * P_ONECOMMA such as 'whichwrap' */
@@ -4966,7 +4966,7 @@ do_set(
 					    /* Remove the duplicated value and
 					     * the next comma. */
 					    STRMOVE(s, s + 2);
-					    s -= 2;
+					    continue;
 					}
 				    }
 				    else
@@ -4975,9 +4975,10 @@ do_set(
 					      && vim_strchr(s + 1, *s) != NULL)
 					{
 					    STRMOVE(s, s + 1);
-					    --s;
+					    continue;
 					}
 				    }
+				    ++s;
 				}
 			    }
 
diff --git a/src/testdir/test_options.vim b/src/testdir/test_options.vim
index bfa942715..ce59ae11b 100644
--- a/src/testdir/test_options.vim
+++ b/src/testdir/test_options.vim
@@ -13,6 +13,12 @@ function! Test_whichwrap()
   set whichwrap+=h,l
   call assert_equal('b,s,h,l', &whichwrap)
 
+  set whichwrap=h,h
+  call assert_equal('h', &whichwrap)
+
+  set whichwrap=h,h,h
+  call assert_equal('h', &whichwrap)
+
   set whichwrap&
 endfunction
 
diff --git a/src/version.c b/src/version.c
index 9273b2baa..78cb27fe6 100644
--- a/src/version.c
+++ b/src/version.c
@@ -764,6 +764,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    305,
 /**/
     304,
 /**/