f05aa68
To: vim-dev@vim.org
f05aa68
Subject: Patch 7.2.279
f05aa68
Fcc: outbox
f05aa68
From: Bram Moolenaar <Bram@moolenaar.net>
f05aa68
Mime-Version: 1.0
f05aa68
Content-Type: text/plain; charset=UTF-8
f05aa68
Content-Transfer-Encoding: 8bit
f05aa68
------------
f05aa68
f05aa68
Patch 7.2.279
f05aa68
Problem:    Invalid memory read with visual mode "r". (Dominique Pelle)
f05aa68
Solution:   Make sure the cursor position is valid.  Don't check the cursor
f05aa68
	    position but the position being used.  And make sure we get the
f05aa68
	    right line.
f05aa68
Files:	    src/misc2.c, src/ops.c
f05aa68
f05aa68
f05aa68
*** ../vim-7.2.278/src/misc2.c	2009-05-16 21:06:36.000000000 +0200
f05aa68
--- src/misc2.c	2009-11-03 16:43:10.000000000 +0100
f05aa68
***************
f05aa68
*** 156,162 ****
f05aa68
  		    || ((ve_flags & VE_ONEMORE) && wcol < MAXCOL)
f05aa68
  #endif
f05aa68
  		    ;
f05aa68
!     line = ml_get_curline();
f05aa68
  
f05aa68
      if (wcol >= MAXCOL)
f05aa68
      {
f05aa68
--- 156,162 ----
f05aa68
  		    || ((ve_flags & VE_ONEMORE) && wcol < MAXCOL)
f05aa68
  #endif
f05aa68
  		    ;
f05aa68
!     line = ml_get_buf(curbuf, pos->lnum, FALSE);
f05aa68
  
f05aa68
      if (wcol >= MAXCOL)
f05aa68
      {
f05aa68
***************
f05aa68
*** 332,340 ****
f05aa68
  #endif
f05aa68
  
f05aa68
  #ifdef FEAT_MBYTE
f05aa68
!     /* prevent cursor from moving on the trail byte */
f05aa68
      if (has_mbyte)
f05aa68
! 	mb_adjust_cursor();
f05aa68
  #endif
f05aa68
  
f05aa68
      if (col < wcol)
f05aa68
--- 332,340 ----
f05aa68
  #endif
f05aa68
  
f05aa68
  #ifdef FEAT_MBYTE
f05aa68
!     /* prevent from moving onto a trail byte */
f05aa68
      if (has_mbyte)
f05aa68
! 	mb_adjustpos(pos);
f05aa68
  #endif
f05aa68
  
f05aa68
      if (col < wcol)
f05aa68
*** ../vim-7.2.278/src/ops.c	2009-09-30 15:15:33.000000000 +0200
f05aa68
--- src/ops.c	2009-11-03 15:18:50.000000000 +0100
f05aa68
***************
f05aa68
*** 2020,2025 ****
f05aa68
--- 2020,2026 ----
f05aa68
  	bd.is_MAX = (curwin->w_curswant == MAXCOL);
f05aa68
  	for ( ; curwin->w_cursor.lnum <= oap->end.lnum; ++curwin->w_cursor.lnum)
f05aa68
  	{
f05aa68
+ 	    curwin->w_cursor.col = 0;  /* make sure cursor position is valid */
f05aa68
  	    block_prep(oap, &bd, curwin->w_cursor.lnum, TRUE);
f05aa68
  	    if (bd.textlen == 0 && (!virtual_op || bd.is_MAX))
f05aa68
  		continue;	    /* nothing to replace */
f05aa68
***************
f05aa68
*** 2035,2040 ****
f05aa68
--- 2036,2042 ----
f05aa68
  	    {
f05aa68
  		pos_T vpos;
f05aa68
  
f05aa68
+ 		vpos.lnum = curwin->w_cursor.lnum;
f05aa68
  		getvpos(&vpos, oap->start_vcol);
f05aa68
  		bd.startspaces += vpos.coladd;
f05aa68
  		n = bd.startspaces;
f05aa68
***************
f05aa68
*** 2693,2703 ****
f05aa68
  			 * initial coladd offset as part of "startspaces" */
f05aa68
  			if (bd.is_short)
f05aa68
  			{
f05aa68
! 			    linenr_T lnum = curwin->w_cursor.lnum;
f05aa68
! 
f05aa68
! 			    curwin->w_cursor.lnum = linenr;
f05aa68
  			    (void)getvpos(&vpos, oap->start_vcol);
f05aa68
- 			    curwin->w_cursor.lnum = lnum;
f05aa68
  			}
f05aa68
  			else
f05aa68
  			    vpos.coladd = 0;
f05aa68
--- 2695,2702 ----
f05aa68
  			 * initial coladd offset as part of "startspaces" */
f05aa68
  			if (bd.is_short)
f05aa68
  			{
f05aa68
! 			    vpos.lnum = linenr;
f05aa68
  			    (void)getvpos(&vpos, oap->start_vcol);
f05aa68
  			}
f05aa68
  			else
f05aa68
  			    vpos.coladd = 0;
f05aa68
*** ../vim-7.2.278/src/version.c	2009-11-03 16:29:48.000000000 +0100
f05aa68
--- src/version.c	2009-11-03 16:41:53.000000000 +0100
f05aa68
***************
f05aa68
*** 678,679 ****
f05aa68
--- 678,681 ----
f05aa68
  {   /* Add new patch number below this line */
f05aa68
+ /**/
f05aa68
+     279,
f05aa68
  /**/
f05aa68
f05aa68
-- 
f05aa68
BEDEVERE: How do you know so much about swallows?
f05aa68
ARTHUR:   Well you have to know these things when you're a king, you know.
f05aa68
                 "Monty Python and the Holy Grail" PYTHON (MONTY) PICTURES LTD
f05aa68
f05aa68
 /// Bram Moolenaar -- Bram@Moolenaar.net -- http://www.Moolenaar.net   \\\
f05aa68
///        sponsor Vim, vote for features -- http://www.Vim.org/sponsor/ \\\
f05aa68
\\\        download, build and distribute -- http://www.A-A-P.org        ///
f05aa68
 \\\            help me help AIDS victims -- http://ICCF-Holland.org    ///