From 13ed494bb5edc5a02d0ed0feabddb68920f88570 Mon Sep 17 00:00:00 2001
From: Bram Moolenaar <Bram@vim.org>
Date: Fri, 19 Aug 2022 13:59:25 +0100
Subject: [PATCH] patch 9.0.0228: crash when pattern looks below the last line

Problem:    Crash when pattern looks below the last line.
Solution:   Consider invalid lines to be empty. (closes #10938)
---
 src/regexp_bt.c                   | 17 +++++++++++------
 src/regexp_nfa.c                  | 14 ++++++++++----
 src/testdir/test_regexp_latin.vim | 12 ++++++++++++
 src/version.c                     |  2 ++
 4 files changed, 35 insertions(+), 10 deletions(-)

diff --git a/src/regexp_bt.c b/src/regexp_bt.c
index e7cb1f2ba..cf484e0ba 100644
--- a/src/regexp_bt.c
+++ b/src/regexp_bt.c
@@ -3439,12 +3439,17 @@ regmatch(
 	    break;
 
 	  case RE_VCOL:
-	    if (!re_num_cmp((long_u)win_linetabsize(
-			    rex.reg_win == NULL ? curwin : rex.reg_win,
-			    rex.reg_firstlnum + rex.lnum,
-			    rex.line,
-			    (colnr_T)(rex.input - rex.line)) + 1, scan))
-		status = RA_NOMATCH;
+	    {
+		win_T	    *wp = rex.reg_win == NULL ? curwin : rex.reg_win;
+		linenr_T    lnum = rex.reg_firstlnum + rex.lnum;
+		long_u	    vcol = 0;
+
+		if (lnum > 0 && lnum <= wp->w_buffer->b_ml.ml_line_count)
+		    vcol = (long_u)win_linetabsize(wp, lnum, rex.line,
+					      (colnr_T)(rex.input - rex.line));
+		if (!re_num_cmp(vcol + 1, scan))
+		    status = RA_NOMATCH;
+	    }
 	    break;
 
 	  case BOW:	// \<word; rex.input points to w
diff --git a/src/regexp_nfa.c b/src/regexp_nfa.c
index 0dbc6b501..f8717f5b1 100644
--- a/src/regexp_nfa.c
+++ b/src/regexp_nfa.c
@@ -6774,10 +6774,16 @@ nfa_regmatch(
 			result = col > t->state->val * ts;
 		    }
 		    if (!result)
-			result = nfa_re_num_cmp(t->state->val, op,
-				(long_u)win_linetabsize(wp,
-						rex.reg_firstlnum + rex.lnum,
-						rex.line, col) + 1);
+		    {
+			linenr_T    lnum = rex.reg_firstlnum + rex.lnum;
+			long_u	    vcol = 0;
+
+			if (lnum > 0
+				   && lnum <= wp->w_buffer->b_ml.ml_line_count)
+			    vcol = (long_u)win_linetabsize(wp, lnum,
+								rex.line, col);
+			result = nfa_re_num_cmp(t->state->val, op, vcol + 1);
+		    }
 		    if (result)
 		    {
 			add_here = TRUE;
diff --git a/src/testdir/test_regexp_latin.vim b/src/testdir/test_regexp_latin.vim
index 1ba7d17a1..bc08439d1 100644
--- a/src/testdir/test_regexp_latin.vim
+++ b/src/testdir/test_regexp_latin.vim
@@ -1129,4 +1129,16 @@ func Test_recursive_substitute_expr()
   delfunc Repl
 endfunc
 
+def Test_compare_columns()
+  # this was using a line below the last line
+  enew
+  setline(1, ['', ''])
+  prop_type_add('name', {highlight: 'ErrorMsg'})
+  prop_add(1, 1, {length: 1, type: 'name'})
+  search('\%#=1\%>.l\n.*\%<2v', 'nW')
+  search('\%#=2\%>.l\n.*\%<2v', 'nW')
+  bwipe!
+  prop_type_delete('name')
+enddef
+
 " vim: shiftwidth=2 sts=2 expandtab
diff --git a/src/version.c b/src/version.c
index 5d69c638d..86be34dba 100644
--- a/src/version.c
+++ b/src/version.c
@@ -731,6 +731,8 @@ static char *(features[]) =
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    228,
 /**/
     227,
 /**/
-- 
2.40.0