To: vim_dev@googlegroups.com
Subject: Patch 9.0.0192
Fcc: outbox
From: Bram Moolenaar <Bram@moolenaar.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
------------

Patch 9.0.0192
Problem:    Possible invalid memory access when 'cmdheight' is zero. (Martin
            Tournoij)
Solution:   Avoid going over the end of w_lines[] when w_height is Rows.
            (closes #10882)
Files:      src/drawscreen.c


*** ../vim-9.0.0191/src/drawscreen.c	2022-07-30 16:54:01.863698294 +0100
--- src/drawscreen.c	2022-08-11 15:45:35.102459178 +0100
***************
*** 1808,1816 ****
  
  			    // Move the entries that were scrolled, disable
  			    // the entries for the lines to be redrawn.
  			    if ((wp->w_lines_valid += j) > wp->w_height)
  				wp->w_lines_valid = wp->w_height;
! 			    for (idx = wp->w_lines_valid; idx - j >= 0; idx--)
  				wp->w_lines[idx] = wp->w_lines[idx - j];
  			    while (idx >= 0)
  				wp->w_lines[idx--].wl_valid = FALSE;
--- 1808,1820 ----
  
  			    // Move the entries that were scrolled, disable
  			    // the entries for the lines to be redrawn.
+ 			    // Avoid using a wrong index when 'cmdheight' is
+ 			    // zero and wp->w_height == Rows.
  			    if ((wp->w_lines_valid += j) > wp->w_height)
  				wp->w_lines_valid = wp->w_height;
! 			    for (idx = wp->w_lines_valid >= wp->w_height
! 				    ? wp->w_height - 1 : wp->w_lines_valid;
! 							   idx - j >= 0; idx--)
  				wp->w_lines[idx] = wp->w_lines[idx - j];
  			    while (idx >= 0)
  				wp->w_lines[idx--].wl_valid = FALSE;
*** ../vim-9.0.0191/src/version.c	2022-08-11 14:13:14.866778338 +0100
--- src/version.c	2022-08-11 15:48:11.757799769 +0100
***************
*** 737,738 ****
--- 737,740 ----
  {   /* Add new patch number below this line */
+ /**/
+     192,
  /**/

-- 
       When danger reared its ugly head,
       He bravely turned his tail and fled
       Yes, Brave Sir Robin turned about
       And gallantly he chickened out
       Bravely taking to his feet
       He beat a very brave retreat
       Bravest of the brave Sir Robin
       Petrified of being dead
       Soiled his pants then brave Sir Robin
       Turned away and fled.
                 "Monty Python and the Holy Grail" PYTHON (MONTY) PICTURES LTD

 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
///                                                                      \\\
\\\        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ ///
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///