thac0/vim
1
0
Fork 0
forked from aniani/vim
Code

patch 9.1.1463: Integer overflow in getmarklist() after linewise operation

Browse Source 
Problem:  Integer overflow in getmarklist() after linewise operation.
Solution: Don't add 1 to MAXCOL (zeertzjq)

related: neovim/neovim#34524
closes: #17552

Signed-off-by: zeertzjq <zeertzjq@outlook.com>
Signed-off-by: Christian Brabandt <cb@256bit.org>
This commit is contained in:
zeertzjq 2025-06-16 20:10:38 +02:00 committed by Christian Brabandt
parent 8ae8b304ee
commit 93318a9933
No known key found for this signature in database
GPG Key ID: F3F92DA383FDDE09
3 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/mark.c
View File

@ -1464,7 +1464,7 @@ add_mark(list_T *l, char_u *mname, pos_T *pos, int bufnr, char_u *fname)
list_append_number(lpos, bufnr);
list_append_number(lpos, pos->lnum);
list_append_number(lpos, pos->col + 1);
list_append_number(lpos, pos->col < MAXCOL ? pos->col + 1 : MAXCOL);
list_append_number(lpos, pos->coladd);
if (dict_add_string(d, "mark", mname) == FAIL

5
src/testdir/test_marks.vim
View File

@ -302,6 +302,11 @@ func Test_getmarklist()
call assert_equal({'mark' : "'r", 'pos' : [bufnr(), 2, 2, 0]},
\ bufnr()->getmarklist()[0])
call assert_equal([], {}->getmarklist())
normal! yy
call assert_equal([
\ {'mark': "'[", 'pos': [bufnr(), 2, 1, 0]},
\ {'mark': "']", 'pos': [bufnr(), 2, v:maxcol, 0]},
\ ], getmarklist(bufnr())[-2:])
close!
endfunc

2
src/version.c
View File

@ -709,6 +709,8 @@ static char *(features[]) =
static int included_patches[] =
{ /* Add new patch number below this line */
/**/
1463,
/**/
1462,
/**/