Skip to content

Commit aef5c62

Browse files
committed
patch 8.1.1497: accessing memory beyond allocated space
Problem: Accessing memory beyond allocated space. Solution: Check column before accessing popup mask.
1 parent acc682b commit aef5c62

2 files changed

Lines changed: 25 additions & 18 deletions

File tree

src/screen.c

Lines changed: 23 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -6797,35 +6797,40 @@ screen_line(
67976797
if (clear_width > 0
67986798
#ifdef FEAT_TEXT_PROP
67996799
&& !(flags & SLF_POPUP) // no separator for popup window
6800-
&& popup_mask[row * screen_Columns + col + coloff] <= screen_zindex
68016800
#endif
68026801
)
68036802
{
68046803
// For a window that has a right neighbor, draw the separator char
6805-
// right of the window contents.
6804+
// right of the window contents. But not on top of a popup window.
68066805
if (coloff + col < Columns)
68076806
{
6808-
int c;
6809-
6810-
c = fillchar_vsep(&hl);
6811-
if (ScreenLines[off_to] != (schar_T)c
6812-
|| (enc_utf8 && (int)ScreenLinesUC[off_to]
6813-
!= (c >= 0x80 ? c : 0))
6814-
|| ScreenAttrs[off_to] != hl)
6807+
#ifdef FEAT_TEXT_PROP
6808+
if (popup_mask[row * screen_Columns + col + coloff]
6809+
<= screen_zindex)
6810+
#endif
68156811
{
6816-
ScreenLines[off_to] = c;
6817-
ScreenAttrs[off_to] = hl;
6818-
if (enc_utf8)
6812+
int c;
6813+
6814+
c = fillchar_vsep(&hl);
6815+
if (ScreenLines[off_to] != (schar_T)c
6816+
|| (enc_utf8 && (int)ScreenLinesUC[off_to]
6817+
!= (c >= 0x80 ? c : 0))
6818+
|| ScreenAttrs[off_to] != hl)
68196819
{
6820-
if (c >= 0x80)
6820+
ScreenLines[off_to] = c;
6821+
ScreenAttrs[off_to] = hl;
6822+
if (enc_utf8)
68216823
{
6822-
ScreenLinesUC[off_to] = c;
6823-
ScreenLinesC[0][off_to] = 0;
6824+
if (c >= 0x80)
6825+
{
6826+
ScreenLinesUC[off_to] = c;
6827+
ScreenLinesC[0][off_to] = 0;
6828+
}
6829+
else
6830+
ScreenLinesUC[off_to] = 0;
68246831
}
6825-
else
6826-
ScreenLinesUC[off_to] = 0;
6832+
screen_char(off_to, row, col + coloff);
68276833
}
6828-
screen_char(off_to, row, col + coloff);
68296834
}
68306835
}
68316836
else

src/version.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -767,6 +767,8 @@ static char *(features[]) =
767767

768768
static int included_patches[] =
769769
{ /* Add new patch number below this line */
770+
/**/
771+
1497,
770772
/**/
771773
1496,
772774
/**/

0 commit comments

Comments
 (0)