From fdc5d17d58cc9c9edc9fb2816e1afaabc531bf1e Mon Sep 17 00:00:00 2001 From: Bram Moolenaar Date: Thu, 11 Aug 2022 15:52:14 +0100 Subject: [PATCH] patch 9.0.0192: possible invalid memory access when 'cmdheight' is zero Problem: Possible invalid memory access when 'cmdheight' is zero. (Martin Tournoij) Solution: Avoid going over the end of w_lines[] when w_height is Rows. (closes #10882) --- src/drawscreen.c | 6 +++++- src/version.c | 2 ++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/src/drawscreen.c b/src/drawscreen.c index 578c66f2b..a5822b25d 100644 --- a/src/drawscreen.c +++ b/src/drawscreen.c @@ -1808,9 +1808,13 @@ win_update(win_T *wp) // Move the entries that were scrolled, disable // the entries for the lines to be redrawn. + // Avoid using a wrong index when 'cmdheight' is + // zero and wp->w_height == Rows. if ((wp->w_lines_valid += j) > wp->w_height) wp->w_lines_valid = wp->w_height; - for (idx = wp->w_lines_valid; idx - j >= 0; idx--) + for (idx = wp->w_lines_valid >= wp->w_height + ? wp->w_height - 1 : wp->w_lines_valid; + idx - j >= 0; idx--) wp->w_lines[idx] = wp->w_lines[idx - j]; while (idx >= 0) wp->w_lines[idx--].wl_valid = FALSE; diff --git a/src/version.c b/src/version.c index c89996625..0369ad200 100644 --- a/src/version.c +++ b/src/version.c @@ -735,6 +735,8 @@ static char *(features[]) = static int included_patches[] = { /* Add new patch number below this line */ +/**/ + 192, /**/ 191, /**/ -- 2.40.0