To: vim_dev@googlegroups.com
Subject: Patch 9.0.0070
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 9.0.0070
Problem:    Using utfc_ptr2char_len() when length is negative.
Solution:   Check value of length. (closes #10760)
Files:      src/screen.c


*** ../vim-9.0.0069/src/screen.c	2022-07-09 04:56:12.522528981 +0100
--- src/screen.c	2022-07-25 19:41:02.793825647 +0100
***************
*** 1571,1591 ****
  	// check if this is the first byte of a multibyte
  	if (has_mbyte)
  	{
! 	    if (enc_utf8 && len > 0)
! 		mbyte_blen = utfc_ptr2len_len(ptr, (int)((text + len) - ptr));
! 	    else
! 		mbyte_blen = (*mb_ptr2len)(ptr);
  	    if (enc_dbcs == DBCS_JPNU && c == 0x8e)
  		mbyte_cells = 1;
  	    else if (enc_dbcs != 0)
  		mbyte_cells = mbyte_blen;
  	    else	// enc_utf8
  	    {
! 		if (len >= 0)
! 		    u8c = utfc_ptr2char_len(ptr, u8cc,
! 						   (int)((text + len) - ptr));
! 		else
! 		    u8c = utfc_ptr2char(ptr, u8cc);
  		mbyte_cells = utf_char2cells(u8c);
  #ifdef FEAT_ARABIC
  		if (p_arshape && !p_tbidi && ARABIC_CHAR(u8c))
--- 1571,1588 ----
  	// check if this is the first byte of a multibyte
  	if (has_mbyte)
  	{
! 	    mbyte_blen = enc_utf8 && len > 0
! 			     ? utfc_ptr2len_len(ptr, (int)((text + len) - ptr))
! 			     : (*mb_ptr2len)(ptr);
  	    if (enc_dbcs == DBCS_JPNU && c == 0x8e)
  		mbyte_cells = 1;
  	    else if (enc_dbcs != 0)
  		mbyte_cells = mbyte_blen;
  	    else	// enc_utf8
  	    {
! 		u8c = len >= 0
! 		      ? utfc_ptr2char_len(ptr, u8cc, (int)((text + len) - ptr))
! 		      : utfc_ptr2char(ptr, u8cc);
  		mbyte_cells = utf_char2cells(u8c);
  #ifdef FEAT_ARABIC
  		if (p_arshape && !p_tbidi && ARABIC_CHAR(u8c))
***************
*** 1599,1606 ****
  		    }
  		    else
  		    {
! 			nc = utfc_ptr2char_len(ptr + mbyte_blen, pcc,
! 				      (int)((text + len) - ptr - mbyte_blen));
  			nc1 = pcc[0];
  		    }
  		    pc = prev_c;
--- 1596,1605 ----
  		    }
  		    else
  		    {
! 			nc = len >= 0
! 				 ? utfc_ptr2char_len(ptr + mbyte_blen, pcc,
! 					(int)((text + len) - ptr - mbyte_blen))
! 				 : utfc_ptr2char(ptr + mbyte_blen, pcc);
  			nc1 = pcc[0];
  		    }
  		    pc = prev_c;
*** ../vim-9.0.0069/src/version.c	2022-07-25 19:07:01.097953885 +0100
--- src/version.c	2022-07-25 19:39:51.277980582 +0100
***************
*** 737,738 ****
--- 737,740 ----
  {   /* Add new patch number below this line */
+ /**/
+     70,
  /**/

-- 
~
~
~
".signature" 4 lines, 50 characters written

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///                                                                      \\\
\\\        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///