Skip to content

Commit bae5a17

Browse files
committed
patch 8.0.0879: crash when shifting with huge number
Problem: Crash when shifting with huge number. Solution: Check for overflow. (Dominique Pelle, closes #1945)
1 parent cae92dc commit bae5a17

File tree

3 files changed

+14
-1
lines changed

3 files changed

+14
-1
lines changed

src/ops.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -396,7 +396,10 @@ shift_block(oparg_T *oap, int amount)
396396
return;
397397

398398
/* total is number of screen columns to be inserted/removed */
399-
total = amount * p_sw;
399+
total = (int)((unsigned)amount * (unsigned)p_sw);
400+
if ((total / p_sw) != amount)
401+
return; /* multiplication overflow */
402+
400403
oldp = ml_get_curline();
401404

402405
if (!left)

src/testdir/test_visual.vim

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,14 @@ func Test_block_shift_multibyte()
1818
q!
1919
endfunc
2020

21+
func Test_block_shift_overflow()
22+
" This used to cause a multiplication overflow followed by a crash.
23+
new
24+
normal ii
25+
exe "normal \<C-V>876543210>"
26+
q!
27+
endfunc
28+
2129
func Test_dotregister_paste()
2230
new
2331
exe "norm! ihello world\<esc>"

src/version.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -769,6 +769,8 @@ static char *(features[]) =
769769

770770
static int included_patches[] =
771771
{ /* Add new patch number below this line */
772+
/**/
773+
879,
772774
/**/
773775
878,
774776
/**/

0 commit comments

Comments
 (0)