neovim

commit cd9ca700e5053f8a9666c917310dcc39651e3bfa
parent 2de3362ce3877b622a26c21214c95c69892b8c63
Author: zeertzjq <zeertzjq@outlook.com>
Date:   Sat, 13 May 2023 22:39:28 +0800

vim-patch:9.0.0598: using negative array index with negative width window

Problem:    Using negative array index with negative width window.
Solution:   Make sure the window width does not become negative.

https://github.com/vim/vim/commit/8279af514ca7e5fd3c31cf13b0864163d1a0bfeb

Co-authored-by: Bram Moolenaar <Bram@vim.org>

Diffstat:
M
src/nvim/window.c
 | 
6
+++++-
M
test/old/testdir/test_cmdwin.vim
 | 
22
++++++++++++++++++++++

2 files changed, 27 insertions(+), 1 deletion(-)
diff --git a/src/nvim/window.c b/src/nvim/window.c
@@ -2304,6 +2304,9 @@ static void win_equal_rec(win_T *next_curwin, bool current, frame_T *topfr, int 
         }
         if (hnc) {                  // add next_curwin size
           next_curwin_size -= (int)p_wiw - (m - n);
+          if (next_curwin_size < 0) {
+            next_curwin_size = 0;
+          }
           new_size += next_curwin_size;
           room -= new_size - next_curwin_size;
         } else {
@@ -6686,7 +6689,8 @@ static int win_border_width(win_T *wp)
 /// Set the width of a window.
 void win_new_width(win_T *wp, int width)
 {
-  wp->w_width = width;
+  // Should we give an error if width < 0?
+  wp->w_width = width < 0 ? 0 : width;
   wp->w_pos_changed = true;
   win_set_inner_size(wp, true);
 }
diff --git a/test/old/testdir/test_cmdwin.vim b/test/old/testdir/test_cmdwin.vim
@@ -41,5 +41,27 @@ func Test_cmdwin_freed_buffer_ptr()
   bwipe!
 endfunc
 
+" This was resulting in a window with negative width.
+" The test doesn't reproduce the illegal memory access though...
+func Test_cmdwin_split_often()
+  let lines = &lines
+  let columns = &columns
+  set t_WS=
+
+  try
+    " set encoding=iso8859
+    set ruler
+    winsize 0 0
+    noremap 0 H
+    sil norm 0000000q:
+  catch /E36:/
+  endtry
+
+  bwipe!
+  set encoding=utf8
+  let &lines = lines
+  let &columns = columns
+endfunc
+
 
 " vim: shiftwidth=2 sts=2 expandtab