64 lines
2.0 KiB
Diff
64 lines
2.0 KiB
Diff
From cb0b99f0672d8446585d26e998343dceca17d1ce Mon Sep 17 00:00:00 2001
|
|
From: Christian Brabandt <cb@256bit.org>
|
|
Date: Tue, 14 Nov 2023 20:05:59 +0100
|
|
Subject: [PATCH] patch 9.0.2107: [security]: FPE in adjust_plines_for_skipcol
|
|
|
|
Problem: [security]: FPE in adjust_plines_for_skipcol
|
|
Solution: don't divide by zero, return zero
|
|
|
|
Prevent a floating point exception when calculating w_skipcol (which can
|
|
happen with a small window when the number option is set and cpo+=n).
|
|
|
|
Add a test to verify
|
|
|
|
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
|
---
|
|
src/move.c | 5 +++--
|
|
src/testdir/test_scroll_opt.vim | 19 +++++++++++++++++++
|
|
2 files changed, 22 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/move.c b/src/move.c
|
|
index ce06dc3394689..fbb352a32e15a 100644
|
|
--- a/src/move.c
|
|
+++ b/src/move.c
|
|
@@ -45,8 +45,9 @@ adjust_plines_for_skipcol(win_T *wp)
|
|
return 0;
|
|
|
|
int width = wp->w_width - win_col_off(wp);
|
|
- if (wp->w_skipcol >= width)
|
|
- return (wp->w_skipcol - width) / (width + win_col_off2(wp)) + 1;
|
|
+ int w2 = width + win_col_off2(wp);
|
|
+ if (wp->w_skipcol >= width && w2 > 0)
|
|
+ return (wp->w_skipcol - width) / w2 + 1;
|
|
|
|
return 0;
|
|
}
|
|
diff --git a/src/testdir/test_scroll_opt.vim b/src/testdir/test_scroll_opt.vim
|
|
index d5d08a24c20d4..342d382c20a5a 100644
|
|
--- a/src/testdir/test_scroll_opt.vim
|
|
+++ b/src/testdir/test_scroll_opt.vim
|
|
@@ -926,4 +926,23 @@ func Test_smoothscroll_cursor_top()
|
|
call StopVimInTerminal(buf)
|
|
endfunc
|
|
|
|
+" Division by zero, shouldn't crash
|
|
+func Test_smoothscroll_crash()
|
|
+ CheckScreendump
|
|
+
|
|
+ let lines =<< trim END
|
|
+ 20 new
|
|
+ vsp
|
|
+ put =repeat('aaaa', 20)
|
|
+ set nu fdc=1 smoothscroll cpo+=n
|
|
+ vert resize 0
|
|
+ exe "norm! 0\<c-e>"
|
|
+ END
|
|
+ call writefile(lines, 'XSmoothScrollCrash', 'D')
|
|
+ let buf = RunVimInTerminal('-u NONE -S XSmoothScrollCrash', #{rows: 12, cols:40})
|
|
+ call term_sendkeys(buf, "2\<C-E>\<C-L>")
|
|
+
|
|
+ call StopVimInTerminal(buf)
|
|
+endfunc
|
|
+
|
|
" vim: shiftwidth=2 sts=2 expandtab
|